Windows Analysis Report
JtH26qoxr2.exe

Overview

General Information

Sample name: JtH26qoxr2.exe
renamed because original name is a hash value
Original sample name: c9e35f3be0a99258747eee4b2bef19f2.exe
Analysis ID: 1647312
MD5: c9e35f3be0a99258747eee4b2bef19f2
SHA1: ba70a487a2da7acb8cfc4a761a4dd8b095cdcb59
SHA256: c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e
Tags: exeuser-abuse_ch
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadey
Yara detected Amadeys Clipper DLL
C2 URLs / IPs found in malware configuration
Contains functionality to start a terminal service
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: JtH26qoxr2.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe ReversingLabs: Detection: 63%
Multi AV Scanner detection for submitted file
Source: JtH26qoxr2.exe Virustotal: Detection: 57% Perma Link
Source: JtH26qoxr2.exe ReversingLabs: Detection: 63%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Sample uses string decryption to hide its real strings
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: 176.113.115.6
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: /Ni9kiput/index.php
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: S-%lu-
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: bb556cff4a
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: rapes.exe
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Startup
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: rundll32
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Programs
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: %USERPROFILE%
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: cred.dll|clip.dll|
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: cred.dll
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: clip.dll
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: http://
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: https://
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: /quiet
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: /Plugins/
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: &unit=
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: shell32.dll
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: kernel32.dll
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: GetNativeSystemInfo
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: ProgramData\
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: AVAST Software
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Kaspersky Lab
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Panda Security
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Doctor Web
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: 360TotalSecurity
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Bitdefender
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Norton
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Sophos
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Comodo
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: WinDefender
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: 0123456789
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: ------
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: ?scr=1
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: ComputerName
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: -unicode-
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: VideoID
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: DefaultSettings.XResolution
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: DefaultSettings.YResolution
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: ProductName
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: CurrentBuild
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: rundll32.exe
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: "taskkill /f /im "
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: " && timeout 1 && del
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: && Exit"
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: " && ren
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Powershell.exe
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: shutdown -s -t 0
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: random
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: Keyboard Layout\Preload
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: 00000419
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: 00000422
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: 00000423
Source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String decryptor: 0000043f
Uses 32bit PE files
Source: JtH26qoxr2.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 176.113.115.6
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Source: Joe Sandbox View IP Address: 176.113.115.6 176.113.115.6
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SELECTELRU SELECTELRU
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.6:49697 -> 176.113.115.6:80
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00132710 recv,recv,recv,recv, 4_2_00132710
Source: rapes.exe, 00000004.00000002.2547579887.000000000142A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9
Source: rapes.exe, 00000004.00000002.2547579887.000000000140F000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000004.00000002.2547579887.000000000143A000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000004.00000002.2547579887.000000000142A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php
Source: rapes.exe, 00000004.00000002.2547579887.000000000140F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php=
Source: rapes.exe, 00000004.00000002.2547579887.000000000140F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpD
Source: rapes.exe, 00000004.00000002.2547579887.000000000140F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpe
Source: rapes.exe, 00000004.00000002.2547579887.000000000140F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpn
Source: rapes.exe, 00000004.00000002.2547579887.000000000143A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpv

System Summary
barindex
PE file contains section with special chars
Source: JtH26qoxr2.exe Static PE information: section name:
Source: JtH26qoxr2.exe Static PE information: section name: .idata
Source: JtH26qoxr2.exe Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: .idata
Source: rapes.exe.0.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process Stats: CPU usage > 49%
Creates files inside the system directory
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File created: C:\Windows\Tasks\rapes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_001261F0 4_2_001261F0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_0012B700 4_2_0012B700
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00164047 4_2_00164047
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_001618D7 4_2_001618D7
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_001251A0 4_2_001251A0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00137320 4_2_00137320
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00152C20 4_2_00152C20
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00125450 4_2_00125450
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_0012CC40 4_2_0012CC40
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00165CD4 4_2_00165CD4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_0014B4C0 4_2_0014B4C0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00165DF4 4_2_00165DF4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_0015C6DD 4_2_0015C6DD
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_0014F6DB 4_2_0014F6DB
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00124EF0 4_2_00124EF0
Uses 32bit PE files
Source: JtH26qoxr2.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: JtH26qoxr2.exe Static PE information: Section: ZLIB complexity 0.9988593319559229
Source: JtH26qoxr2.exe Static PE information: Section: gfoqiqyq ZLIB complexity 0.9947438295887002
Source: rapes.exe.0.dr Static PE information: Section: ZLIB complexity 0.9988593319559229
Source: rapes.exe.0.dr Static PE information: Section: gfoqiqyq ZLIB complexity 0.9947438295887002
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File created: C:\Users\user\AppData\Local\Temp\bb556cff4a Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: JtH26qoxr2.exe Virustotal: Detection: 57%
Source: JtH26qoxr2.exe ReversingLabs: Detection: 63%
Source: JtH26qoxr2.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: JtH26qoxr2.exe String found in binary or memory: " /add /y
Source: JtH26qoxr2.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add /y
Source: rapes.exe String found in binary or memory: " /add
Source: rapes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe String found in binary or memory: " /add /y
Source: rapes.exe String found in binary or memory: " /add
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File read: C:\Users\user\Desktop\JtH26qoxr2.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\JtH26qoxr2.exe "C:\Users\user\Desktop\JtH26qoxr2.exe"
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: JtH26qoxr2.exe Static file information: File size 1951232 > 1048576
Source: JtH26qoxr2.exe Static PE information: Raw size of gfoqiqyq is bigger than: 0x100000 < 0x1ab000

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Unpacked PE file: 0.2.JtH26qoxr2.exe.70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gfoqiqyq:EW;epsuwcfd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gfoqiqyq:EW;epsuwcfd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 2.2.rapes.exe.120000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gfoqiqyq:EW;epsuwcfd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gfoqiqyq:EW;epsuwcfd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Unpacked PE file: 4.2.rapes.exe.120000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gfoqiqyq:EW;epsuwcfd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gfoqiqyq:EW;epsuwcfd:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: JtH26qoxr2.exe Static PE information: real checksum: 0x1e7a41 should be: 0x1e7f28
Source: rapes.exe.0.dr Static PE information: real checksum: 0x1e7a41 should be: 0x1e7f28
PE file contains sections with non-standard names
Source: JtH26qoxr2.exe Static PE information: section name:
Source: JtH26qoxr2.exe Static PE information: section name: .idata
Source: JtH26qoxr2.exe Static PE information: section name:
Source: JtH26qoxr2.exe Static PE information: section name: gfoqiqyq
Source: JtH26qoxr2.exe Static PE information: section name: epsuwcfd
Source: JtH26qoxr2.exe Static PE information: section name: .taggant
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: .idata
Source: rapes.exe.0.dr Static PE information: section name:
Source: rapes.exe.0.dr Static PE information: section name: gfoqiqyq
Source: rapes.exe.0.dr Static PE information: section name: epsuwcfd
Source: rapes.exe.0.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00149FC1 push ecx; ret 4_2_00149FD4
Source: JtH26qoxr2.exe Static PE information: section name: entropy: 7.985141287264434
Source: JtH26qoxr2.exe Static PE information: section name: gfoqiqyq entropy: 7.953983487587648
Source: rapes.exe.0.dr Static PE information: section name: entropy: 7.985141287264434
Source: rapes.exe.0.dr Static PE information: section name: gfoqiqyq entropy: 7.953983487587648
Drops PE files
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File created: C:\Windows\Tasks\rapes.job Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 254FA5 second address: 254FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 26628E second address: 2662A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F0CBC76E2E6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 266401 second address: 26642D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnp 00007F0CBD31BCD6h 0x0000000e popad 0x0000000f jmp 00007F0CBD31BCE9h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2668A8 second address: 2668BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC76E2DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2668BB second address: 2668C5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CBD31BCD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2668C5 second address: 2668D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F0CBC76E2DCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2668D7 second address: 26690A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F0CBD31BCD6h 0x00000009 jmp 00007F0CBD31BCE1h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F0CBD31BCDFh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269867 second address: 2698A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d sub dword ptr [ebp+122D17DBh], ecx 0x00000013 push 00000000h 0x00000015 jmp 00007F0CBC76E2DAh 0x0000001a push 245CE916h 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2698A2 second address: 26991F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0CBD31BCD6h 0x0000000a popad 0x0000000b pop edx 0x0000000c xor dword ptr [esp], 245CE996h 0x00000013 xor edx, dword ptr [ebp+122D36ECh] 0x00000019 push 00000003h 0x0000001b mov esi, dword ptr [ebp+122D393Fh] 0x00000021 push 00000000h 0x00000023 and dh, FFFFFFD5h 0x00000026 clc 0x00000027 push 00000003h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007F0CBD31BCD8h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 call 00007F0CBD31BCD9h 0x00000048 pushad 0x00000049 pushad 0x0000004a pushad 0x0000004b popad 0x0000004c jno 00007F0CBD31BCD6h 0x00000052 popad 0x00000053 jng 00007F0CBD31BCD8h 0x00000059 pushad 0x0000005a popad 0x0000005b popad 0x0000005c push eax 0x0000005d pushad 0x0000005e jmp 00007F0CBD31BCE0h 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 26991F second address: 269925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269925 second address: 26995A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007F0CBD31BCE8h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0CBD31BCE0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 26995A second address: 26997D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jg 00007F0CBC76E2E2h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push ecx 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 26997D second address: 2699B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 xor dword ptr [ebp+122D28C2h], esi 0x0000000d lea ebx, dword ptr [ebp+1245A70Ch] 0x00000013 and esi, dword ptr [ebp+122D3793h] 0x00000019 jmp 00007F0CBD31BCDAh 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 jmp 00007F0CBD31BCDDh 0x00000027 pop ecx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2699B2 second address: 2699C8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CBC76E2D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F0CBC76E2E4h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269A40 second address: 269A45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269B47 second address: 269B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269B4D second address: 269B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269B51 second address: 269B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269C0C second address: 269C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269C12 second address: 269C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 269C16 second address: 269C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 640A5B80h 0x0000000f and edi, dword ptr [ebp+122D3A53h] 0x00000015 push 00000003h 0x00000017 sbb esi, 00742FDEh 0x0000001d push 00000000h 0x0000001f sub dword ptr [ebp+122D296Ah], edx 0x00000025 push 00000003h 0x00000027 jg 00007F0CBD31BCD8h 0x0000002d push C349761Ch 0x00000032 jo 00007F0CBD31BCE4h 0x00000038 push eax 0x00000039 push edx 0x0000003a push ecx 0x0000003b pop ecx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 25D690 second address: 25D6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CBC76E2E8h 0x00000010 jnl 00007F0CBC76E2D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 25D6B9 second address: 25D6BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 25D6BD second address: 25D6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jp 00007F0CBC76E2D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28845E second address: 288462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288462 second address: 288468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288468 second address: 28846E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288594 second address: 288598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288598 second address: 2885B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBD31BCE8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2885B4 second address: 2885C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CBC76E2DCh 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2885C9 second address: 2885D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2885D4 second address: 2885D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2889D9 second address: 2889EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0CBD31BCD6h 0x0000000a jo 00007F0CBD31BCD6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288E07 second address: 288E0D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288E0D second address: 288E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288E13 second address: 288E17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288F8B second address: 288F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288F8F second address: 288FB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0CBC76E2E9h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288FB4 second address: 288FCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBD31BCE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288FCF second address: 288FD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288FD5 second address: 288FF2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0CBD31BCD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 288FF2 second address: 288FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0CBC76E2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289163 second address: 28916E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0CBD31BCD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289355 second address: 289361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0CBC76E2D6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2895FB second address: 289605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0CBD31BCD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289605 second address: 289613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289613 second address: 289617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 27E5B8 second address: 27E5E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E3h 0x00000007 jmp 00007F0CBC76E2E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 27E5E6 second address: 27E5FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBD31BCE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 27E5FB second address: 27E5FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 27E5FF second address: 27E63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBD31BCE9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0CBD31BCE0h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jl 00007F0CBD31BCE4h 0x00000018 jnp 00007F0CBD31BCDEh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 25004F second address: 250055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 250055 second address: 250075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F0CBD31BCE9h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 250075 second address: 25007B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 25007B second address: 25007F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28976F second address: 289775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289775 second address: 289779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289779 second address: 28977F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289F7D second address: 289F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289F85 second address: 289FA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBC76E2E7h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289FA2 second address: 289FB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 289FB0 second address: 289FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28D80F second address: 28D81B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28DDB2 second address: 28DDD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F0CBC76E2DCh 0x00000013 jns 00007F0CBC76E2D6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28DDD6 second address: 28DDEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F0CBD31BCD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28DDEE second address: 28DDF8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0CBC76E2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28DDF8 second address: 28DDFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28DDFE second address: 28DE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 28DE02 second address: 28DE06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 295859 second address: 295877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jns 00007F0CBC76E2D6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0CBC76E2DCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 295877 second address: 29587C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 251ACB second address: 251AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC76E2E6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 251AE8 second address: 251AED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 294CC3 second address: 294CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2950EF second address: 2950F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2950F3 second address: 295103 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CBC76E2D6h 0x00000008 jng 00007F0CBC76E2D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 295103 second address: 29513D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CBD31BCE0h 0x00000008 push esi 0x00000009 jmp 00007F0CBD31BCE8h 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jng 00007F0CBD31BCD6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2953E2 second address: 2953F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F0CBC76E2D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2953F4 second address: 2953F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2953F8 second address: 295405 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0CBC76E2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 298D7A second address: 298D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push eax 0x00000007 jg 00007F0CBD31BCD6h 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 298D8D second address: 298D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 299528 second address: 29954E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jno 00007F0CBD31BCE6h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29954E second address: 299552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 299552 second address: 299558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 299558 second address: 29955D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29955D second address: 299563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2997F8 second address: 2997FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29A4BE second address: 29A4C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29A53E second address: 29A542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29A542 second address: 29A546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29A546 second address: 29A55F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jmp 00007F0CBC76E2DAh 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29B56B second address: 29B571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29D350 second address: 29D354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29DABF second address: 29DAC9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0CBD31BCDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29E82F second address: 29E840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0CBC76E2D6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A420D second address: 2A4212 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A5258 second address: 2A525D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A433C second address: 2A4340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A4340 second address: 2A434E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F0CBC76E2D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A539A second address: 2A539F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A546C second address: 2A5471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A82C3 second address: 2A82D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F0CBD31BCDCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A91BE second address: 2A91C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A84C2 second address: 2A84C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A84C8 second address: 2A84E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F0CBC76E2D6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F0CBC76E2DDh 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A91C3 second address: 2A920D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F0CBD31BCD6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d or dword ptr [ebp+12481DC0h], edi 0x00000013 push 00000000h 0x00000015 mov ebx, dword ptr [ebp+12461A9Eh] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F0CBD31BCD8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov edi, ebx 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jp 00007F0CBD31BCD8h 0x00000042 push ecx 0x00000043 pop ecx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AA1C0 second address: 2AA1C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AA1C4 second address: 2AA1C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AA1C8 second address: 2AA1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2A942A second address: 2A9430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AA1CE second address: 2AA22A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CBC76E2DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop esi 0x00000010 pop ebx 0x00000011 nop 0x00000012 add ebx, dword ptr [ebp+122D278Fh] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F0CBC76E2D8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 pushad 0x00000035 je 00007F0CBC76E2DCh 0x0000003b mov edi, dword ptr [ebp+122D2D64h] 0x00000041 mov esi, dword ptr [ebp+122D397Bh] 0x00000047 popad 0x00000048 push 00000000h 0x0000004a mov di, si 0x0000004d xchg eax, esi 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AA22A second address: 2AA22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AB3FA second address: 2AB400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AA3EC second address: 2AA3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC3E2 second address: 2AC3F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC3F9 second address: 2AC492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnc 00007F0CBD31BCD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F0CBD31BCD8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F0CBD31BCD8h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 jne 00007F0CBD31BCE2h 0x0000004d jmp 00007F0CBD31BCDFh 0x00000052 jmp 00007F0CBD31BCE6h 0x00000057 push 00000000h 0x00000059 mov edi, dword ptr [ebp+122D36FFh] 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push edi 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC492 second address: 2AC497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AD62C second address: 2AD630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AD630 second address: 2AD682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F0CBC76E2D8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D39ABh] 0x00000028 mov dword ptr [ebp+1246AE25h], edi 0x0000002e push 00000000h 0x00000030 sbb bx, FFFAh 0x00000035 push 00000000h 0x00000037 mov edi, 13C627A3h 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f jg 00007F0CBC76E2D8h 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AE5CB second address: 2AE5D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AE5D1 second address: 2AE5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC5FD second address: 2AC602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC602 second address: 2AC68E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F0CBC76E2E4h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov ebx, dword ptr [ebp+122D2EBAh] 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F0CBC76E2D8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov edi, ecx 0x0000003e sub edi, 2EFBB817h 0x00000044 mov eax, dword ptr [ebp+122D0119h] 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d call 00007F0CBC76E2D8h 0x00000052 pop eax 0x00000053 mov dword ptr [esp+04h], eax 0x00000057 add dword ptr [esp+04h], 00000016h 0x0000005f inc eax 0x00000060 push eax 0x00000061 ret 0x00000062 pop eax 0x00000063 ret 0x00000064 mov di, E3A3h 0x00000068 push FFFFFFFFh 0x0000006a mov dword ptr [ebp+122D3105h], ecx 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 push edi 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC68E second address: 2AC693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC693 second address: 2AC69D instructions: 0x00000000 rdtsc 0x00000002 je 00007F0CBC76E2DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AC69D second address: 2AC6A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AF607 second address: 2AF60D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AF60D second address: 2AF611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B05B9 second address: 2B05BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2AD7D5 second address: 2AD867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBD31BCDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F0CBD31BCD8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov ebx, eax 0x00000028 or dword ptr [ebp+122D181Ch], edx 0x0000002e push dword ptr fs:[00000000h] 0x00000035 xor dword ptr [ebp+122D3105h], esi 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov dword ptr [ebp+122D2926h], ebx 0x00000048 mov eax, dword ptr [ebp+122D0FD9h] 0x0000004e movsx edi, di 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ebp 0x00000056 call 00007F0CBD31BCD8h 0x0000005b pop ebp 0x0000005c mov dword ptr [esp+04h], ebp 0x00000060 add dword ptr [esp+04h], 0000001Ch 0x00000068 inc ebp 0x00000069 push ebp 0x0000006a ret 0x0000006b pop ebp 0x0000006c ret 0x0000006d add di, 6935h 0x00000072 push eax 0x00000073 push esi 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B05BD second address: 2B05C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B05C1 second address: 2B0642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F0CBD31BCD8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D1832h], eax 0x0000002a and bh, FFFFFFF7h 0x0000002d push 00000000h 0x0000002f xor ebx, dword ptr [ebp+122D39A7h] 0x00000035 push 00000000h 0x00000037 mov edi, dword ptr [ebp+122D3983h] 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f push ecx 0x00000040 jmp 00007F0CBD31BCE6h 0x00000045 pop ecx 0x00000046 pushad 0x00000047 pushad 0x00000048 popad 0x00000049 jmp 00007F0CBD31BCE9h 0x0000004e popad 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push esi 0x00000054 pushad 0x00000055 popad 0x00000056 pop esi 0x00000057 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B16C3 second address: 2B16C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B087B second address: 2B0880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B2868 second address: 2B287F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBC76E2DAh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B52C2 second address: 2B52C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2B9AA2 second address: 2B9AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2BE37B second address: 2BE381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2BE381 second address: 2BE386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2BE386 second address: 2BE38B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 24AF08 second address: 24AF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0CBC76E2E4h 0x0000000c jmp 00007F0CBC76E2E0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 24AF33 second address: 24AF37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 24AF37 second address: 24AF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 24AF3D second address: 24AF43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 24AF43 second address: 24AF48 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2BDABF second address: 2BDAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 jo 00007F0CBD31BCEFh 0x0000000d jmp 00007F0CBD31BCE3h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2BDC41 second address: 2BDC45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2BDC45 second address: 2BDC57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0CBD31BCD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2BDEE2 second address: 2BDF13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CBC76E2E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C3346 second address: 2C3362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F0CBD31BCE6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C3362 second address: 2C336C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0CBC76E2D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C4934 second address: 2C493E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F0CBD31BCD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C9D0E second address: 2C9D29 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0CBC76E2D6h 0x00000008 jmp 00007F0CBC76E2E1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C9D29 second address: 2C9D41 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0CBD31BCE2h 0x00000008 jo 00007F0CBD31BCD6h 0x0000000e jl 00007F0CBD31BCD6h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C9D41 second address: 2C9D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C9D47 second address: 2C9D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C8A8B second address: 2C8ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F0CBC76E2E2h 0x0000000a jmp 00007F0CBC76E2E8h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C8ABC second address: 2C8ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F0CBD31BCD6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C8ACC second address: 2C8AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 js 00007F0CBC76E2D6h 0x0000000f jmp 00007F0CBC76E2E9h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 jg 00007F0CBC76E2DCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C90E3 second address: 2C90E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C90E9 second address: 2C90EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C9242 second address: 2C925C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0CBD31BCDFh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C9755 second address: 2C976C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C98D1 second address: 2C98E2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0CBD31BCD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C98E2 second address: 2C9906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push ebx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0CBC76E2E5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2C9906 second address: 2C991E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBD31BCE4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CF81F second address: 2CF825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CF825 second address: 2CF837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jnc 00007F0CBD31BCD6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CE6BB second address: 2CE6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CE6BF second address: 2CE6CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0CBD31BCD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CE82B second address: 2CE82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CE9B8 second address: 2CE9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0CBD31BCD6h 0x0000000a pop edi 0x0000000b jbe 00007F0CBD31BCDCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CEAF9 second address: 2CEB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0CBC76E2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CEB03 second address: 2CEB0D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0CBD31BCD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CEB0D second address: 2CEB4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F0CBC76E2E6h 0x00000011 pushad 0x00000012 ja 00007F0CBC76E2D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CEB4B second address: 2CEB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CECC1 second address: 2CECE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b jmp 00007F0CBC76E2E2h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CF2B2 second address: 2CF2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0CBD31BCD6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0CBD31BCDBh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CF2CC second address: 2CF2D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CDF55 second address: 2CDF9C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0CBD31BCD6h 0x00000008 jnl 00007F0CBD31BCD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F0CBD31BCE3h 0x00000015 jmp 00007F0CBD31BCDFh 0x0000001a push edx 0x0000001b jmp 00007F0CBD31BCDDh 0x00000020 pop edx 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CDF9C second address: 2CDFA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2CDFA2 second address: 2CDFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D4484 second address: 2D4495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F0CBC76E2DAh 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D4495 second address: 2D44C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBD31BCE0h 0x00000008 jmp 00007F0CBD31BCE8h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F0CBD31BCD6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 25A039 second address: 25A043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3375 second address: 2D3391 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 js 00007F0CBD31BCEEh 0x0000000f jmp 00007F0CBD31BCDAh 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296755 second address: 2967AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, 19DB0D08h 0x00000012 lea eax, dword ptr [ebp+124874FBh] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F0CBC76E2D8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D1B32h], esi 0x00000038 nop 0x00000039 jmp 00007F0CBC76E2DEh 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jp 00007F0CBC76E2D6h 0x00000048 push ecx 0x00000049 pop ecx 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2967AB second address: 27E5B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0CBD31BCE4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ecx, 2DA67780h 0x00000010 pushad 0x00000011 mov ah, 95h 0x00000013 mov dword ptr [ebp+122D1B07h], eax 0x00000019 popad 0x0000001a call dword ptr [ebp+12458601h] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jg 00007F0CBD31BCD6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296882 second address: 296887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296887 second address: 2968A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBD31BCE6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296981 second address: 296985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296C7D second address: 296C87 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CBD31BCD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296C87 second address: 296C8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296C8D second address: 296C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296C91 second address: 296C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296E90 second address: 296EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0CBD31BCDBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296EA3 second address: 296EA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296F27 second address: 296F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296F2B second address: 296F2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296F2F second address: 296F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296F3F second address: 296F5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a mov di, BFF8h 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 296F5B second address: 296F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007F0CBD31BCDCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29720F second address: 297240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0CBC76E2E1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 297240 second address: 29726E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CBD31BCDDh 0x0000000b popad 0x0000000c nop 0x0000000d push 00000004h 0x0000000f or ecx, 1685A480h 0x00000015 mov dword ptr [ebp+122D35F8h], ecx 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e jbe 00007F0CBD31BCDCh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29726E second address: 297272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 29768B second address: 297691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 297691 second address: 2976C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F0CBC76E2E7h 0x0000000e push 0000001Eh 0x00000010 mov di, CA2Eh 0x00000014 nop 0x00000015 jl 00007F0CBC76E2E4h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2976C2 second address: 2976C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2976C6 second address: 2976DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F0CBC76E2DCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 297A06 second address: 297A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 297ADF second address: 27F146 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CBC76E2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c mov edi, eax 0x0000000e lea eax, dword ptr [ebp+124874FBh] 0x00000014 cld 0x00000015 push eax 0x00000016 jp 00007F0CBC76E2DEh 0x0000001c jng 00007F0CBC76E2D8h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 mov dword ptr [esp], eax 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007F0CBC76E2D8h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 call dword ptr [ebp+122D2966h] 0x00000047 push esi 0x00000048 jp 00007F0CBC76E2DCh 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 pop edx 0x00000052 pop esi 0x00000053 push ebx 0x00000054 jng 00007F0CBC76E2DCh 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 27F146 second address: 27F14D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 297A94 second address: 297ADF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F0CBC76E2DFh 0x0000000e lea eax, dword ptr [ebp+1248753Fh] 0x00000014 push ebx 0x00000015 mov edx, dword ptr [ebp+1245EF11h] 0x0000001b pop ecx 0x0000001c nop 0x0000001d jno 00007F0CBC76E2EEh 0x00000023 push eax 0x00000024 push ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3755 second address: 2D378E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0CBD31BCDEh 0x00000008 jne 00007F0CBD31BCD6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jc 00007F0CBD31BCDEh 0x00000016 jp 00007F0CBD31BCD6h 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f pop eax 0x00000020 je 00007F0CBD31BCF1h 0x00000026 push eax 0x00000027 push edx 0x00000028 jno 00007F0CBD31BCD6h 0x0000002e jmp 00007F0CBD31BCDBh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 297ACF second address: 297AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 297AD3 second address: 297ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3B92 second address: 2D3B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3B98 second address: 2D3BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F0CBD31BCDCh 0x0000000d jo 00007F0CBD31BCD6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3D30 second address: 2D3D36 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3D36 second address: 2D3D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0CBD31BCE5h 0x0000000d jmp 00007F0CBD31BCE8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3D6B second address: 2D3D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0CBC76E2DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D3EE7 second address: 2D3EF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBD31BCDAh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D407A second address: 2D4080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D4080 second address: 2D4086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D4086 second address: 2D408B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D408B second address: 2D40B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBD31BCE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jg 00007F0CBD31BCD6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D40B1 second address: 2D40B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2DAA21 second address: 2DAA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBD31BCE6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2DAA3C second address: 2DAA57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC76E2E6h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9AF3 second address: 2D9AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9AF7 second address: 2D9B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pushad 0x00000009 jp 00007F0CBC76E2D6h 0x0000000f jmp 00007F0CBC76E2E7h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9DF5 second address: 2D9DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9DF9 second address: 2D9DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9DFF second address: 2D9E04 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9F70 second address: 2D9F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9F76 second address: 2D9F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F0CBD31BCD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9F85 second address: 2D9F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D9559 second address: 2D955D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2D955D second address: 2D9563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2DA498 second address: 2DA49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2DA768 second address: 2DA775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F0CBC76E2D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2DD730 second address: 2DD734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2E396F second address: 2E397B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2E6A6C second address: 2E6A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0CBD31BCD6h 0x0000000a jmp 00007F0CBD31BCDDh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2E6A84 second address: 2E6A89 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2E666A second address: 2E666E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2E67B5 second address: 2E67B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2E67B9 second address: 2E67C3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CBD31BCE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2EE642 second address: 2EE657 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F0CBC76E2DAh 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2EDA1A second address: 2EDA22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2EDA22 second address: 2EDA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2EE0C9 second address: 2EE0F1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CBD31BCD6h 0x00000008 jmp 00007F0CBD31BCE9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F3332 second address: 2F333C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F333C second address: 2F3348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0CBD31BCD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2974E9 second address: 2974EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2974EF second address: 29750A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBD31BCE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2976D7 second address: 2976DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F34A0 second address: 2F34B3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0CBD31BCD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F7A7C second address: 2F7A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F7A82 second address: 2F7A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F7D5D second address: 2F7D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F7D61 second address: 2F7D8A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jo 00007F0CBD31BCD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F0CBD31BCE9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F7D8A second address: 2F7DBF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0CBC76E2D6h 0x00000008 jmp 00007F0CBC76E2DAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F0CBC76E2EAh 0x00000015 jmp 00007F0CBC76E2E2h 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d pushad 0x0000001e push edx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F7DBF second address: 2F7DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007F0CBD31BCE9h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F80AB second address: 2F80AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2F80AF second address: 2F80D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CBD31BCDAh 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F0CBD31BCDDh 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 300613 second address: 30063F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CBC76E2DAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0CBC76E2E3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30063F second address: 300676 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBD31BCE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CBD31BCE6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 300676 second address: 30067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30067A second address: 30067E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2FE8FF second address: 2FE91A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F0CBC76E2E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2FE91A second address: 2FE949 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBD31BCE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CBD31BCE9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2FF478 second address: 2FF492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CBC76E2E4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2FF492 second address: 2FF4A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBD31BCDAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2FFD6F second address: 2FFD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30002F second address: 300058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnc 00007F0CBD31BCD8h 0x0000000b jmp 00007F0CBD31BCE6h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30514C second address: 305158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F0CBC76E2D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3068D7 second address: 306908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC50D829h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007F0CBC50D81Eh 0x00000012 jnl 00007F0CBC50D816h 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3099CC second address: 3099D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3099D2 second address: 3099DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0CBC50D816h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 309CF6 second address: 309D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBCD7D635h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 309D14 second address: 309D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 309D1A second address: 309D33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D62Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 309D33 second address: 309D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 309D37 second address: 309D47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jnp 00007F0CBCD7D626h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 309D47 second address: 309D5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F0CBC50D816h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A01F second address: 30A042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBCD7D62Dh 0x00000009 jmp 00007F0CBCD7D632h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A042 second address: 30A04C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CBC50D816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A04C second address: 30A06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F0CBCD7D634h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A1BC second address: 30A1C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A1C2 second address: 30A1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A1C8 second address: 30A1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A1CD second address: 30A1F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0CBCD7D626h 0x0000000a jmp 00007F0CBCD7D639h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A1F0 second address: 30A200 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F0CBC50D816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A200 second address: 30A204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A491 second address: 30A495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A495 second address: 30A499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A499 second address: 30A4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CBC50D826h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F0CBC50D822h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A62F second address: 30A649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0CBCD7D631h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A649 second address: 30A673 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F0CBC50D834h 0x0000000f jmp 00007F0CBC50D81Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 30A673 second address: 30A677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 313548 second address: 313554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 313554 second address: 313570 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D634h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 313570 second address: 31357A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0CBC50D816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 31357A second address: 313580 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3117FF second address: 311808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 311B94 second address: 311B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 311B98 second address: 311BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC50D81Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jc 00007F0CBC50D816h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jne 00007F0CBC50D818h 0x0000001e jnl 00007F0CBC50D818h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 311BC6 second address: 311BEE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F0CBCD7D62Dh 0x00000008 jmp 00007F0CBCD7D631h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 311BEE second address: 311BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 311D52 second address: 311D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0CBCD7D637h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 311ED9 second address: 311F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC50D826h 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F0CBC50D81Eh 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 je 00007F0CBC50D81Eh 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 312084 second address: 3120AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBCD7D62Dh 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jg 00007F0CBCD7D626h 0x0000001b push esi 0x0000001c pop esi 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3120AC second address: 3120B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3120B2 second address: 3120B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3121FB second address: 312222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC50D81Dh 0x00000009 jmp 00007F0CBC50D821h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 312222 second address: 312228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3123CB second address: 3123D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3123D3 second address: 3123DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 312661 second address: 312665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 31C55A second address: 31C55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 31C55E second address: 31C59F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D820h 0x00000007 jmp 00007F0CBC50D825h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F0CBC50D828h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32989F second address: 3298A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3298A3 second address: 3298DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jbe 00007F0CBC50D816h 0x0000000f pop edi 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F0CBC50D832h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3298DC second address: 3298E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3298E0 second address: 3298E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3298E6 second address: 3298F4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F0CBCD7D626h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32C41B second address: 32C41F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32C41F second address: 32C425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32C425 second address: 32C42E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32F77F second address: 32F789 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0CBCD7D626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32F789 second address: 32F7B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBC50D828h 0x00000009 jmp 00007F0CBC50D81Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32F7B0 second address: 32F7BE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CBCD7D626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 32F7BE second address: 32F7C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2534DB second address: 2534E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 2534E3 second address: 253504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0CBC50D829h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 33E021 second address: 33E027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 34536B second address: 345390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0CBC50D828h 0x0000000c ja 00007F0CBC50D816h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 34576F second address: 345773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 345773 second address: 3457A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC50D81Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F0CBC50D81Ah 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jmp 00007F0CBC50D822h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 345951 second address: 345956 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 345AB3 second address: 345ACD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D823h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 345ACD second address: 345AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBCD7D634h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 345AE6 second address: 345B0F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0CBC50D822h 0x00000008 jno 00007F0CBC50D81Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 345B0F second address: 345B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jnc 00007F0CBCD7D626h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3491CD second address: 3491F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F0CBC50D825h 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F0CBC50D816h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 352936 second address: 352945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F0CBCD7D626h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 352945 second address: 352949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 35689B second address: 3568B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D630h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3568B1 second address: 3568B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 260E24 second address: 260E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007F0CBCD7D626h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 260E32 second address: 260E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBC50D825h 0x00000009 popad 0x0000000a jbe 00007F0CBC50D81Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 260E54 second address: 260E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jo 00007F0CBCD7D626h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 260E63 second address: 260E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F0CBC50D816h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 35DF4C second address: 35DF51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 35DF51 second address: 35DF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 35A21E second address: 35A24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CBCD7D633h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0CBCD7D633h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 35A24B second address: 35A24F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 35A24F second address: 35A257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D49C second address: 36D4A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D4A4 second address: 36D4AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D60D second address: 36D62F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D827h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D62F second address: 36D633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D633 second address: 36D637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D637 second address: 36D643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D643 second address: 36D647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 36D647 second address: 36D64D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3819BC second address: 3819C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3866E0 second address: 3866E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3866E5 second address: 386700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBC50D827h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 386700 second address: 386715 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0CBCD7D62Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 386715 second address: 38671C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3858F8 second address: 385911 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007F0CBCD7D626h 0x00000011 jno 00007F0CBCD7D626h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 385BFA second address: 385C00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 385C00 second address: 385C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jns 00007F0CBCD7D626h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push ebx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3862F1 second address: 3862F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 3862F9 second address: 386310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F0CBCD7D62Eh 0x0000000b jp 00007F0CBCD7D626h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 386310 second address: 386314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 386314 second address: 38631A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38643A second address: 386443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38D895 second address: 38D8CD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CBCD7D626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F0CBCD7D62Eh 0x00000011 jc 00007F0CBCD7D628h 0x00000017 pushad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e push edi 0x0000001f push edi 0x00000020 pop edi 0x00000021 pop edi 0x00000022 jmp 00007F0CBCD7D62Bh 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push ecx 0x0000002e pop ecx 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38D8CD second address: 38D8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38F324 second address: 38F37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0CBCD7D62Ah 0x0000000a push edx 0x0000000b jmp 00007F0CBCD7D633h 0x00000010 pop edx 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a jbe 00007F0CBCD7D626h 0x00000020 push edx 0x00000021 pop edx 0x00000022 jmp 00007F0CBCD7D639h 0x00000027 popad 0x00000028 pushad 0x00000029 ja 00007F0CBCD7D626h 0x0000002f pushad 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38F37E second address: 38F395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0CBC50D81Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38EEB7 second address: 38EEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F0CBCD7D626h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38EEC4 second address: 38EEDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBC50D827h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 38EEDF second address: 38EEE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D206E4 second address: 4D206E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D206E8 second address: 4D20704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D638h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20704 second address: 4D2077B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0CBC50D821h 0x00000009 and al, FFFFFF96h 0x0000000c jmp 00007F0CBC50D821h 0x00000011 popfd 0x00000012 movzx esi, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push esp 0x00000019 jmp 00007F0CBC50D828h 0x0000001e mov dword ptr [esp], ebp 0x00000021 jmp 00007F0CBC50D820h 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F0CBC50D827h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D2077B second address: 4D20793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBCD7D634h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20793 second address: 4D20797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0C92 second address: 4CE0CA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D62Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0CA1 second address: 4CE0D10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 6Ch 0x00000005 pushfd 0x00000006 jmp 00007F0CBC50D820h 0x0000000b sub ch, FFFFFFA8h 0x0000000e jmp 00007F0CBC50D81Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F0CBC50D826h 0x0000001d push eax 0x0000001e jmp 00007F0CBC50D81Bh 0x00000023 xchg eax, ebp 0x00000024 jmp 00007F0CBC50D826h 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c mov ax, 39BDh 0x00000030 push eax 0x00000031 push edx 0x00000032 mov cx, 805Fh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3084E second address: 4D30852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30852 second address: 4D30856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30856 second address: 4D3085C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3085C second address: 4D30862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30862 second address: 4D3087E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0CBCD7D62Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3087E second address: 4D30884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30884 second address: 4D3088A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3088A second address: 4D308A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D308A5 second address: 4D308A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D308A9 second address: 4D308AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CA0C3B second address: 4CA0C65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D62Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0CBCD7D637h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CA0C65 second address: 4CA0C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CA0C6B second address: 4CA0C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CA0CFD second address: 4CA0D0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CA0D0D second address: 4CA0D1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBCD7D62Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CA0D1F second address: 4CA0D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CA0D23 second address: 4CA0D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CBCD7D62Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3001B second address: 4D30048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0CBC50D81Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30048 second address: 4D30066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ah, bh 0x0000000d push eax 0x0000000e push edx 0x0000000f movzx eax, di 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20D03 second address: 4D20D20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20D20 second address: 4D20D50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F0CBCD7D633h 0x00000012 pop eax 0x00000013 push edx 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20D50 second address: 4D20DA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F0CBC50D81Bh 0x00000016 and ecx, 2EC3B53Eh 0x0000001c jmp 00007F0CBC50D829h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pop edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20DA1 second address: 4D20DB6 instructions: 0x00000000 rdtsc 0x00000002 mov cx, D195h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, 7725F211h 0x0000000d popad 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20DB6 second address: 4D20DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20DBA second address: 4D20DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20DC0 second address: 4D20DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20DC6 second address: 4D20DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20DCA second address: 4D20DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30426 second address: 4D3042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3042C second address: 4D30449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F0CBC50D81Dh 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30449 second address: 4D3044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3044E second address: 4D3047A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0CBC50D827h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D3047A second address: 4D304A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBCD7D62Fh 0x00000008 mov ah, C4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and dword ptr [eax], 00000000h 0x00000010 jmp 00007F0CBCD7D62Bh 0x00000015 and dword ptr [eax+04h], 00000000h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D304A9 second address: 4D304C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D827h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D304C4 second address: 4D304DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBCD7D634h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CD0A15 second address: 4CD0A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CD0A28 second address: 4CD0A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CD0A2E second address: 4CD0A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D20809 second address: 4D2080F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D2080F second address: 4D20813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30278 second address: 4D30288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBCD7D62Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D30288 second address: 4D302B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F0CBC50D826h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D302B8 second address: 4D302D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D00C7B second address: 4D00CF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0CBC50D81Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F0CBC50D821h 0x00000017 xor ecx, 0CA604D6h 0x0000001d jmp 00007F0CBC50D821h 0x00000022 popfd 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F0CBC50D81Eh 0x0000002a sbb esi, 36ABEAF8h 0x00000030 jmp 00007F0CBC50D81Bh 0x00000035 popfd 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4D00CF7 second address: 4D00D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 jmp 00007F0CBCD7D634h 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f mov eax, 746BDCEDh 0x00000014 mov dx, cx 0x00000017 popad 0x00000018 mov eax, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jmp 00007F0CBCD7D631h 0x00000023 pushfd 0x00000024 jmp 00007F0CBCD7D630h 0x00000029 sbb esi, 6A8416E8h 0x0000002f jmp 00007F0CBCD7D62Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF08FF second address: 4CF0903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF0903 second address: 4CF0909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF0909 second address: 4CF090F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF090F second address: 4CF0913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF0913 second address: 4CF0941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F0CBC50D820h 0x00000012 sbb cx, 1558h 0x00000017 jmp 00007F0CBC50D81Bh 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF0941 second address: 4CF0989 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, 4BEE8488h 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F0CBCD7D62Eh 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F0CBCD7D630h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F0CBCD7D637h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF0989 second address: 4CF09F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0CBC50D81Fh 0x00000009 add si, 4EDEh 0x0000000e jmp 00007F0CBC50D829h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F0CBC50D820h 0x0000001a xor ah, FFFFFFD8h 0x0000001d jmp 00007F0CBC50D81Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov eax, dword ptr [ebp+08h] 0x00000029 pushad 0x0000002a mov bx, cx 0x0000002d mov cx, 9387h 0x00000031 popad 0x00000032 and dword ptr [eax], 00000000h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov di, 21AAh 0x0000003c mov si, di 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CF09F8 second address: 4CF0A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0CBCD7D62Ah 0x00000008 pop eax 0x00000009 call 00007F0CBCD7D62Bh 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F0CBCD7D630h 0x0000001c sub eax, 200B22C8h 0x00000022 jmp 00007F0CBCD7D62Bh 0x00000027 popfd 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB00F3 second address: 4CB00FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB00FB second address: 4CB0117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBCD7D638h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0117 second address: 4CB011B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB011B second address: 4CB0129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov cl, bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0129 second address: 4CB0155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D824h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a call 00007F0CBC50D820h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0155 second address: 4CB017D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 jmp 00007F0CBCD7D637h 0x0000000d and esp, FFFFFFF8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB017D second address: 4CB0181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0181 second address: 4CB0187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0187 second address: 4CB01AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0CBC50D827h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB01AF second address: 4CB020A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBCD7D62Fh 0x00000008 pushfd 0x00000009 jmp 00007F0CBCD7D638h 0x0000000e and cx, A888h 0x00000013 jmp 00007F0CBCD7D62Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007F0CBCD7D632h 0x00000025 pop eax 0x00000026 mov bx, 1FA6h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB020A second address: 4CB0234 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0CBC50D827h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0234 second address: 4CB024C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBCD7D634h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB024C second address: 4CB028F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0CBC50D829h 0x00000012 add si, 8BC6h 0x00000017 jmp 00007F0CBC50D821h 0x0000001c popfd 0x0000001d mov eax, 3DBEE077h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB028F second address: 4CB030D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0CBCD7D633h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F0CBCD7D639h 0x0000000f add ch, FFFFFF86h 0x00000012 jmp 00007F0CBCD7D631h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esp], ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 call 00007F0CBCD7D633h 0x00000026 pop eax 0x00000027 call 00007F0CBCD7D639h 0x0000002c pop ecx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB030D second address: 4CB0326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0326 second address: 4CB0381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushfd 0x00000006 jmp 00007F0CBCD7D638h 0x0000000b sub eax, 7DFE9118h 0x00000011 jmp 00007F0CBCD7D62Bh 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, esi 0x00000019 jmp 00007F0CBCD7D636h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007F0CBCD7D62Ch 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0381 second address: 4CB039F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop eax 0x0000000f push edi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB039F second address: 4CB03BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D630h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB03BC second address: 4CB03C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB03C0 second address: 4CB03DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB03DD second address: 4CB03FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, 33h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB03FB second address: 4CB041D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0CBCD7D634h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB041D second address: 4CB0423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0423 second address: 4CB0451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D62Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c pushad 0x0000000d jmp 00007F0CBCD7D62Ch 0x00000012 mov ax, 4391h 0x00000016 popad 0x00000017 test esi, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0451 second address: 4CB0455 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0455 second address: 4CB045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB045B second address: 4CB0492 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D820h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0D2E9FB9BCh 0x0000000f jmp 00007F0CBC50D820h 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0492 second address: 4CB0498 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0498 second address: 4CB04A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CBC50D81Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB04A7 second address: 4CB0500 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0D2F26B7A2h 0x0000000e jmp 00007F0CBCD7D635h 0x00000013 mov edx, dword ptr [esi+44h] 0x00000016 jmp 00007F0CBCD7D62Eh 0x0000001b or edx, dword ptr [ebp+0Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jmp 00007F0CBCD7D62Dh 0x00000026 call 00007F0CBCD7D630h 0x0000002b pop ecx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0500 second address: 4CB0532 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CBC50D81Ah 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 jmp 00007F0CBC50D820h 0x00000016 jne 00007F0D2E9FB978h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0532 second address: 4CB0538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0538 second address: 4CB053E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB053E second address: 4CB0580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [esi+48h], 00000001h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F0CBCD7D62Fh 0x00000015 or ax, A3BEh 0x0000001a jmp 00007F0CBCD7D639h 0x0000001f popfd 0x00000020 mov bx, si 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CB0580 second address: 4CB05F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0CBC50D823h 0x00000009 jmp 00007F0CBC50D823h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F0CBC50D828h 0x00000015 or esi, 252B1648h 0x0000001b jmp 00007F0CBC50D81Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 jne 00007F0D2E9FB8DEh 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0CBC50D825h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0073 second address: 4CE0090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0090 second address: 4CE0094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0094 second address: 4CE00A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D62Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE00A7 second address: 4CE0100 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F0CBC50D826h 0x00000017 add ah, 00000038h 0x0000001a jmp 00007F0CBC50D81Bh 0x0000001f popfd 0x00000020 mov eax, 62A5476Fh 0x00000025 popad 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0100 second address: 4CE0104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0104 second address: 4CE010A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE010A second address: 4CE01BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, CD7Bh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F0CBCD7D62Ch 0x00000010 xchg eax, ebx 0x00000011 pushad 0x00000012 movzx ecx, dx 0x00000015 mov eax, edx 0x00000017 popad 0x00000018 push ebp 0x00000019 jmp 00007F0CBCD7D632h 0x0000001e mov dword ptr [esp], esi 0x00000021 jmp 00007F0CBCD7D630h 0x00000026 mov esi, dword ptr [ebp+08h] 0x00000029 jmp 00007F0CBCD7D630h 0x0000002e sub ebx, ebx 0x00000030 jmp 00007F0CBCD7D631h 0x00000035 test esi, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F0CBCD7D633h 0x00000040 sub ax, C87Eh 0x00000045 jmp 00007F0CBCD7D639h 0x0000004a popfd 0x0000004b jmp 00007F0CBCD7D630h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE01BE second address: 4CE0241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D81Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0D2E9C39D7h 0x0000000f jmp 00007F0CBC50D826h 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b jmp 00007F0CBC50D820h 0x00000020 mov ecx, esi 0x00000022 pushad 0x00000023 call 00007F0CBC50D81Eh 0x00000028 call 00007F0CBC50D822h 0x0000002d pop esi 0x0000002e pop edi 0x0000002f movzx esi, di 0x00000032 popad 0x00000033 je 00007F0D2E9C3990h 0x00000039 pushad 0x0000003a mov bh, 4Fh 0x0000003c mov ebx, esi 0x0000003e popad 0x0000003f test byte ptr [77226968h], 00000002h 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0241 second address: 4CE0248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0248 second address: 4CE026D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBC50D820h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F0D2E9C3970h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ax, di 0x00000015 mov bx, 983Ch 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE026D second address: 4CE0273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0273 second address: 4CE02E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov ecx, 35C62E35h 0x00000011 pushfd 0x00000012 jmp 00007F0CBC50D822h 0x00000017 sbb ax, AE88h 0x0000001c jmp 00007F0CBC50D81Bh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 movzx esi, bx 0x00000028 mov bx, C964h 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007F0CBC50D81Ah 0x00000033 xchg eax, ebx 0x00000034 jmp 00007F0CBC50D820h 0x00000039 xchg eax, ebx 0x0000003a jmp 00007F0CBC50D820h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 movsx ebx, cx 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE02E8 second address: 4CE0307 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D635h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE0307 second address: 4CE030B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE030B second address: 4CE0316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 mov edx, 3A0708D8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CE03FD second address: 4CE0407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JtH26qoxr2.exe RDTSC instruction interceptor: First address: 4CD0230 second address: 4CD02CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CBCD7D62Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F0CBCD7D637h 0x00000010 push ecx 0x00000011 pushfd 0x00000012 jmp 00007F0CBCD7D62Fh 0x00000017 add cx, E20Eh 0x0000001c jmp 00007F0CBCD7D639h 0x00000021 popfd 0x00000022 pop eax 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007F0CBCD7D638h 0x0000002d pushfd 0x0000002e jmp 00007F0CBCD7D632h 0x00000033 xor esi, 0963D2E8h 0x00000039 jmp 00007F0CBCD7D62Bh 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Special instruction interceptor: First address: E2AF2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Special instruction interceptor: First address: E00BE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Special instruction interceptor: First address: 29692B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Special instruction interceptor: First address: 31CE7A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 192AF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 1900BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 34692B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Special instruction interceptor: First address: 3CCE7A instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Code function: 0_2_04D40540 rdtsc 0_2_04D40540
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 1821 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 506 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Window / User API: threadDelayed 2041 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7884 Thread sleep time: -56028s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7856 Thread sleep count: 1821 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7856 Thread sleep time: -3643821s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7844 Thread sleep count: 506 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7844 Thread sleep time: -15180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7956 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7880 Thread sleep count: 2041 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7880 Thread sleep time: -4084041s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread delayed: delay time: 180000 Jump to behavior
Source: rapes.exe, rapes.exe, 00000004.00000002.2546879269.000000000031D000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: rapes.exe, 00000004.00000002.2547579887.000000000142A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: JtH26qoxr2.exe, 00000000.00000002.1366693480.000000000026D000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000002.00000002.1404808165.000000000031D000.00000040.00000001.01000000.00000007.sdmp, rapes.exe, 00000004.00000002.2546879269.000000000031D000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: rapes.exe, 00000004.00000002.2547579887.00000000013F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: C:\Users\user\Desktop\JtH26qoxr2.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Code function: 0_2_04D40540 rdtsc 0_2_04D40540
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_0014DB60 mov eax, dword ptr fs:[00000030h] 4_2_0014DB60
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00155FF2 mov eax, dword ptr fs:[00000030h] 4_2_00155FF2
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\JtH26qoxr2.exe Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" Jump to behavior
Source: rapes.exe Binary or memory string: H\^Program Manager
Source: JtH26qoxr2.exe, 00000000.00000002.1366693480.000000000026D000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000002.00000002.1404808165.000000000031D000.00000040.00000001.01000000.00000007.sdmp, rapes.exe, 00000004.00000002.2546879269.000000000031D000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: ^Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_00149AB5 cpuid 4_2_00149AB5
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_001493A7 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 4_2_001493A7
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe Code function: 4_2_001261F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegEnumValueA,DeleteObject,DeleteObject,DeleteObject,LookupAccountNameA, 4_2_001261F0

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys Clipper DLL
Source: Yara match File source: 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1326413160.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1366611332.0000000000071000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2546784713.0000000000121000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1404730008.0000000000121000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1364524749.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Contains functionality to start a terminal service
Source: JtH26qoxr2.exe String found in binary or memory: net start termservice
Source: JtH26qoxr2.exe, 00000000.00000003.1326413160.0000000004B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: JtH26qoxr2.exe, 00000000.00000003.1326413160.0000000004B10000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: JtH26qoxr2.exe, 00000000.00000002.1366611332.0000000000071000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: net start termservice
Source: JtH26qoxr2.exe, 00000000.00000002.1366611332.0000000000071000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000002.1404730008.0000000000121000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000002.1404730008.0000000000121000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000002.00000003.1364524749.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000003.1364524749.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe String found in binary or memory: net start termservice
Source: rapes.exe, 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000004.00000003.1651270377.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000004.00000002.2546784713.0000000000121000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: net start termservice
Source: rapes.exe, 00000004.00000002.2546784713.0000000000121000.00000040.00000001.01000000.00000007.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1647312 Sample: JtH26qoxr2.exe Startdate: 24/03/2025 Architecture: WINDOWS Score: 100 22 Found malware configuration 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 7 other signatures 2->28 6 JtH26qoxr2.exe 5 2->6         started        10 rapes.exe 12 2->10         started        process3 dnsIp4 16 C:\Users\user\AppData\Local\...\rapes.exe, PE32 6->16 dropped 18 C:\Users\user\...\rapes.exe:Zone.Identifier, ASCII 6->18 dropped 30 Detected unpacking (changes PE section rights) 6->30 32 Contains functionality to start a terminal service 6->32 34 Tries to evade debugger and weak emulator (self modifying code) 6->34 36 Tries to detect virtualization through RDTSC time measurements 6->36 13 rapes.exe 6->13         started        20 176.113.115.6, 80 SELECTELRU Russian Federation 10->20 38 Hides threads from debuggers 10->38 40 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->40 42 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 10->42 file5 signatures6 process7 signatures8 44 Antivirus detection for dropped file 13->44 46 Multi AV Scanner detection for dropped file 13->46 48 Detected unpacking (changes PE section rights) 13->48 50 6 other signatures 13->50
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
176.113.115.6
 unknown Russian Federation
49505 SELECTELRU true