Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe
Analysis ID:1609023
MD5:e2df3d65784e6202d297bec31d1dfaa1
SHA1:a74be156066f49f56bd5835e35210591b7010634
SHA256:c539384c0034cc40b226df8cf1354eb264c0e48e722fdd44205ce6783122dba8
Tags:exeuser-SecuriteInfoCom
Infos:

Detection

SystemBC
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected SystemBC
Connects to a pastebin service (likely for C&C)
Connects to many IPs within the same subnet mask (likely port scanning)
Connects to many ports of the same IP (likely port scanning)
DNS related to crypt mining pools
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries Google from non browser process on port 80
Send many emails (e-Mail Spam)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to resolve many domain names, but no domain seems valid
Uses dynamic DNS services
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Connects to many different domains
Connects to several IPs in different countries
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the PEB
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Executes massive DNS lookups (> 100)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Sigma detected: Suspicious Outbound SMTP Connections
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • lfaslh.exe (PID: 6904 cmdline: C:\ProgramData\hkij\lfaslh.exe MD5: E2DF3D65784E6202D297BEC31D1DFAA1)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
SystemBCSystemBC is a proxy malware leveraging SOCKS5. Based on screenshots used in ads on a underground marketplace, Proofpoint decided to call it SystemBC.SystemBC has been observed occasionally, but more pronounced since June 2019. First samples goes back to October 2018.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.systembc

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.2399961206.0000000004764000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_SystemBCYara detected SystemBCJoe Security
    00000002.00000003.2429373659.0000000004784000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_SystemBCYara detected SystemBCJoe Security
      Process Memory Space: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe PID: 6708JoeSecurity_SystemBCYara detected SystemBCJoe Security
        Process Memory Space: lfaslh.exe PID: 6904JoeSecurity_SystemBCYara detected SystemBCJoe Security

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Suspicious Outbound SMTP Connections
          Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 213.209.1.145, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\ProgramData\hkij\lfaslh.exe, Initiated: true, ProcessId: 6904, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 58541

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2025-02-07T08:22:35.198185+010020127862Potentially Bad Traffic192.168.2.12646831.1.1.153UDP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeAvira: detected
          Antivirus detection for dropped file
          Source: C:\ProgramData\hkij\lfaslh.exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
          Multi AV Scanner detection for dropped file
          Source: C:\ProgramData\hkij\lfaslh.exeReversingLabs: Detection: 57%
          Multi AV Scanner detection for submitted file
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeVirustotal: Detection: 45%Perma Link
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeReversingLabs: Detection: 57%
          Joe Sandbox ML detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for dropped file
          Source: C:\ProgramData\hkij\lfaslh.exeJoe Sandbox ML: detected
          Machine Learning detection for sample
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeJoe Sandbox ML: detected

          Bitcoin Miner

          barindex
          DNS related to crypt mining pools
          Source: unknownDNS query: name: tswbbw.com
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

          Networking

          barindex
          Connects to a pastebin service (likely for C&C)
          Source: unknownDNS query: name: securesmtp.dmobin.com
          Connects to many IPs within the same subnet mask (likely port scanning)
          Source: global trafficTCP traffic: Count: 10 IPs: 217.160.0.48,217.160.0.88,217.160.0.219,217.160.0.40,217.160.0.176,217.160.0.220,217.160.0.155,217.160.0.179,217.160.0.127,217.160.0.174
          Connects to many ports of the same IP (likely port scanning)
          Source: global trafficTCP traffic: 142.251.9.26 ports 25,465,4,587,5,6
          Source: global trafficTCP traffic: 13.248.169.48 ports 2525,465,587,5,7,8
          Source: global trafficTCP traffic: 64.190.63.222 ports 2525,465,587,5,7,8
          Source: global trafficTCP traffic: 142.251.5.26 ports 25,465,587,5,7,8
          Performs DNS queries to domains with low reputation
          Source: DNS query: secure.kramble.xyz
          Source: DNS query: daniabogda.xyz
          Source: DNS query: daniabogda.xyz
          Queries Google from non browser process on port 80
          Source: C:\ProgramData\hkij\lfaslh.exeHTTP traffic: GET http://v4.ident.me?Z78706324841Q1 HTTP/1.1 Host: v4.ident.me Cookie: Z78706324841Q1 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https://best-proxies.ru/faq/#from) Referer: https://google.com/ Content-Type: application/x-www-form-urlencoded Content-Length: 9 Connection: close Data Raw: 70 6f 73 74 3d 74 72 75 65 0d 0a 0d 0a Data Ascii: post=true
          Tries to resolve many domain names, but no domain seems valid
          Source: unknownDNS traffic detected: query: mail.geste-posture.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.virtualthinking.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.kazco-construction.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.gmbol.cem replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.anja.ammuca.eu replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.perf-acad.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.111.comyr.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: mail.verajoppig.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.g.fayar.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.mode-d.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.merchavia.org.il replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: orbnge.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.maennle-architektur.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.digitalextremes.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.electrix.co.kr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.SCG.COM replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.abafer.com.ar replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.griffintravelandcruise.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.admmul.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.einboxs.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.mcglashan.schoolnz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.hanakat.fi replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.bird-ext.co replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.wstrucking.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.lexxe.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.vhbknjkl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.sharonlwilliams.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.maquinariaoviedo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.yashima-c.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.piuunica.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.popmailset.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.hsuas.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.dmobin.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.lenmckeowntreeservice.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.uqam.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.helinet.cokr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.click21.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.lassenview.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.dupolnext.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.tuhs.nyc replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.kumbaya.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.plaidproductions.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: dpfcrp.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: essschools.k12.wi.us replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.philstilewarehouse.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.marchison.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: algat.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.gcsm.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.zvonimir.biz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.qfs.sd replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.ig.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.edu.eng.asu.eg replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.imprint-print.couk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.carm.es replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.fuse.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: tswbbw.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.thekitchenandfurnituredoctor.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.frelinghuysenmiddleschool.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pauloalvesweb.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.artisan-atl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.hurted.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.intercontinentalexchange.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.kernowma.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.advanceadvertising.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.sdso.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.hometelchandigarh.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.dartaero.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.carsten-reichel.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.paran.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.cityservicesmanagement.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.pncadvisors.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.abdelhafid-mahmoudi.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: securesmtp.bredband.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.jewbaby.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.mctvnet.ne.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.gdhost.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.thefirstteehammond.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.010315.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: endrix.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: kalos.se replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.arcadezentrum.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.nachtbrut.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.fahajo.hu replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.jagareforbundet.se replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.simetrix-solutions.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.jefferies.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.matanovascular.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.schott-systeme.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.asellerator.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.ics.fi replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.alumnos.uacj.mx replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.p16.f177.n450.z2.fidonet.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.localnet.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.jcpenney.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.wa-living.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.thelinklab.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.robnewton.fsnetcouk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.8keys.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.satnick.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.magicskinpakistan.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.suprematextil.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.tomcosmix.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.pop.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.karma.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.fsdpiojfsdoif.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.risheng.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.meetouts.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.eigsi.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.sarahmoore.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.ars.com.my replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.n-aweb.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.cgshowerscreens.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.wemo-barbing.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.sick.hu replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.gracewaukesha.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.ehcnigeria.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.medikul.se replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.topaz.plala.or.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.manunt.df.vbn.vpn replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: vfe.watchit.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: famoushumanmammals.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.gbmsyw.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.doerner-muenchen.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.crannog-software.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.lifestyleandfashion.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.creativeabstracts.co.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.kind.ocn.ne.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.victorissa.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.marioaranovich.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.akunzom.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.syvilmedia.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.livingxtreme.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: bmerhbfc.bnr.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.fdghghj.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.comprecraft.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: bigozzy.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: secure.aramco.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.raytel.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.naarb.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.hellofit.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.alpinor.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.mfe.tn replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.tm4yp.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: 162.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: mail.pulsepharmacy.cm.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.gaughancompanies.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.promobil24.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.ttvb.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.silverboxphotographers.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.nisshinkiso.co.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.franciscampiglia.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.grandevie.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.arcaluminium.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.lpu.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pandupballons.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.drewnex.eu replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.equinoxcomm.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.tcco.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.ironmarket.co replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.arnet.com.ar replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.cellc.blackberry.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.partiu.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.kernico.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.katapulk.tk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.vision-team.eu replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.romuender.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.johnsoninsolympia.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.davidlorensullivan.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.vilatzara.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.wlynwy.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.rszvls.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: 8b05dh.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pbfigu.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.trendybrandykids.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.colegioalberteinsteinhuaraz.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: rajiv.me.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.schmerbeck.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.tic-osaka.gr.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.brtph632.bnr.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.sony.com.tw replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.cosma.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.web.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.msi.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.sh11.no replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.baltzar.fi replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.westwoodpharmacy.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.ntk.co.kr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: lumeahlandscapes.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.iujgkw.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.restaurantbollywood.mobi replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ahoo.com.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.millardps.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.avalongeorge.comn replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.aydinisi.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.integralindo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.rcaempresarial.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.mcepl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.scm-canada.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.salud.madrid.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.tjlvzxco.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.closeupactors.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.toroaluminum.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.filmz4me.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.lamm-schlat.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.hostelcasacolon.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.noviloire.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.giljanatravel.be replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.awaishah.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.genesis-imaging.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.digivs.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.hopgoodillustration.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.Boltblue.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.prccoolstuff.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.iqgroup.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.halifax.sja.org.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: guayabaverde.co replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.karate-do.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: testwww.commandersofevony.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.granuflolawsuits.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.tula.co replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.getbacktogether123.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.grupogaetec.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mojpoklon.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.legi-mark.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.ujealous.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.lacostita.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.musical-linares.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.cederoc.zej replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.appsys.hu replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.tryde.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.drlimon.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.targetimpianti.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.its.jnj.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.sailrsp.co replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.leunfy.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.connect-whv.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.milestn.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.kinkymonkey.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.channelcambodia.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.Zenythmediahouse.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.spjasliska.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.shonajoy.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.benxenamduclong.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pok98.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.alice.nl replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.austin.com.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: xnxgmf.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: hamthack.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.magyar-mediterranea.com.es replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.tepra.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.humanistics.org.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.esberard.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.sehati.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.vsnl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.dit.gov.bt replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.berryglobal.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.epmitalia.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.uncorksouthafrica.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ajcmatic.cl replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.nus.dk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: multra.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.newberry.me replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.twendly.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.emoticoniley.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.escolatec.lbv.org.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.amentemilionaria.online replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.ellertson.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.p4ed.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.vunubugih.olecko.pl replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: rimprojects.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.globaloffice.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.iojiuht7ygb.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.event.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.bardstown.jideco.co.jp replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: 123box.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.eco-systems.com.ua replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.tsn30.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: khoschk.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.kamelot-clan.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.mail.polimi.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.etu.univ-tlse3.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.t-omeine.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.sepsis-center.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.mogadon.imag.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.axiombio.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: slater240.fsnet.co.uk replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: dian-gov-co-1.fortimailcloud.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.daiwik.co.in replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.elettrodieselsrl.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.flyinggiraffes.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.sfdcgbv.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.eon.hungaria.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: securesmtp.g5design.net.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.playwire.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.tele2allin.be replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.88keys.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.1968bird.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.janvoshol.nl replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.biedenkopf.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.beatmedia.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.jacksonvilleitconsulting.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: securesmtp.keithcharlton.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.herbold.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.ionmedia.tv replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.dbfinancial.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.swatchgirl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.bendel.tie.cl replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: darkangel2000.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.ultrapay.us replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.deserthighlandsscottsdale.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.trever.karoo.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.anderson3.k12.sc.us replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.dalkey.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.raummagie.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.knology.nst replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.wellspring.co.in replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.usach.cl replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.jacobsmack.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.accountants4hire.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.decolarhost.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.daltonbscomputer.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.stelfoxuk.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.mdchappell75.karoo.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: tianya.cn replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: smtp.tablatalkbooks.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.blsecc.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.hindson-jones.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.redthegreen.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.agostomultimidia.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.seecivil.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.studiomicke.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.thiagoarraes.co replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.technologiesnouvelles.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.panasiakorea.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.l.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.sut100.fsnet.co.uk replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: secure.gsy.bias.ne.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.againstthem.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.motivation.ro replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.ankarapatent.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: orbebrusil.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.tkg.bbiq.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.accademiahotelpadova.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: cree-8.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.qq.co replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: oandmcontractors.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.osteopathiceducation.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: brightsparksbushcraft.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.prespa.co.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.simi.is replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.clubinternet.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.ruxcon.org.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.kuttnerundkollegen.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.edwedwj.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.deadlytedly.org.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.hq-law.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.aryaninfotech.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.bildu.es replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.antoniofullone.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: jsjaj.jdjd replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.brinkle.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: hejmbol.cem replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.burninglibra.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.ulife.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.haspafinanzholding.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.inboxsky.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.inspiregestao.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.cdw.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.68monkeys.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.pillu.in replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: o-sei.co.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.crmc-communities.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.watson65.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.brotcafe.com.tr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.crest.ocn.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: exite.it replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: secure.pah.org.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.escal.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.mlb.ukcom replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wagon-gmbh.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.pinggolfvn.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.openlibraray.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.baltzar.fi replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.beyondcommercial.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.stellerlining.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: police.vic.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.hexcape.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.excite.co.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.aask.co.uk replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: secure.outsource-business.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.web.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.salmakov.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.rbmdltd.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.gvre.gr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.mintchoco.site replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.ytinifnipictures.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.imunidadedigital.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.nobugspc.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.fechtverband.onmicrosoft.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.vokac.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.enel.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: jvbcollege.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.riodsign.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.mail2go.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.palyja.co.id replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.svk.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: vzmkmooedd.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.lkvekcsaxhdk.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.tkcnf.of.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.interviewdesign.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.wicksons.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.gleniron.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.libero.es replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: hostmobil.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.basil.ocn.ne.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.osrecruiting.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.rtve.es replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.alicedsl.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.hispasat.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: testwww.commandersofevony.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: smtp.theanswer.co.nz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: weezer.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.lenordhotel.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.marketingsavvy.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.theprairiepeddlerantiques.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.dunmow-hypnosis.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.tre-ap.gov.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.platoonrecords.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.transact.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.qj9.so-net.ne.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.austem.cokr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.yguzqzxn.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: gs.uz replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: smtp.joeishee.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.glail.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.simmonscanada.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.ideasjean.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.galleryx.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.scottgeek.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.mkrhost.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.mv-hallstadt.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.abland.demon.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.crimsonoakacademy.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: korax.pluscom replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.standardcc.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.togo0.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.dixonschools.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: sancharnet.in replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: the-grovers.couk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mbchealth.co.za replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.richardson.armymil replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.smokenewhere.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.email.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.fixnettelecom.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.browninsurance.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.autotrasportimm.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.rheinfussball.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.theholloways.me.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.greyhall.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.kemjapan.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.patelwood.in replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.cammda.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.laketinaroorealty.com.au replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.transcrime.unitn.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.het.con replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.elevn59.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.fotoramadigital.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.eujleek.fr replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.brandywineregional.org replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.gte.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.vanes.co.jp replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: whoffmanns.de replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.cumbyisdstudent.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.2m.lv replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.inspiradigital.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: emphoto.karoo.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.melrose.k112.mn.us replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pxygxaov.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.thefamily.co.uk replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.cab.gov.on.ca replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.baccides.com.br replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.civic18.fsnet.co.uk replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: out.marchesifratelli.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.esopro.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.pcgood.pt replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.comercialaliwen.cl replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: secure.solutionproviderus.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: out.key4.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.ipscteinaudi.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.greenclima.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.ch2m.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.mariapetronelli.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.dhamarket.com replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: securesmtp.baltzar.fi replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.chopandhue.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.deepfriedneon.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.clear.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: smtp.happy-mac.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: securesmtp.nordimpiantivr.it replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mail.ofbs.com replaycode: Name error (3)
          Uses dynamic DNS services
          Source: unknownDNS query: name: smtp.softron.no-ip.com
          Source: unknownNetwork traffic detected: DNS query count 3390
          Source: unknownNetwork traffic detected: IP country count 25
          Source: global trafficTCP traffic: 192.168.2.12:49710 -> 88.119.165.46:4000
          Source: global trafficTCP traffic: 192.168.2.12:58541 -> 213.209.1.145:587
          Source: global trafficTCP traffic: 192.168.2.12:58542 -> 188.114.97.3:587
          Source: global trafficTCP traffic: 192.168.2.12:58543 -> 193.122.131.100:587
          Source: global trafficTCP traffic: 192.168.2.12:58544 -> 64.59.128.135:587
          Source: global trafficTCP traffic: 192.168.2.12:58545 -> 20.23.151.207:587
          Source: global trafficTCP traffic: 192.168.2.12:58546 -> 13.35.58.117:587
          Source: global trafficTCP traffic: 192.168.2.12:58548 -> 104.19.239.228:587
          Source: global trafficTCP traffic: 192.168.2.12:58549 -> 194.19.134.66:587
          Source: global trafficTCP traffic: 192.168.2.12:58550 -> 104.76.200.128:587
          Source: global trafficTCP traffic: 192.168.2.12:58552 -> 165.160.15.20:587
          Source: global trafficTCP traffic: 192.168.2.12:58553 -> 182.248.170.98:587
          Source: global trafficTCP traffic: 192.168.2.12:58554 -> 142.251.9.26:587
          Source: global trafficTCP traffic: 192.168.2.12:58555 -> 64.136.44.50:587
          Source: global trafficTCP traffic: 192.168.2.12:58556 -> 194.2.0.87:587
          Source: global trafficTCP traffic: 192.168.2.12:62481 -> 130.63.236.137:587
          Source: global trafficTCP traffic: 192.168.2.12:62483 -> 217.70.178.3:587
          Source: global trafficTCP traffic: 192.168.2.12:62484 -> 52.62.236.135:587
          Source: global trafficTCP traffic: 192.168.2.12:62485 -> 5.183.84.11:587
          Source: global trafficTCP traffic: 192.168.2.12:62486 -> 35.71.162.15:587
          Source: global trafficTCP traffic: 192.168.2.12:62487 -> 35.226.176.186:587
          Source: global trafficTCP traffic: 192.168.2.12:62490 -> 45.33.2.79:587
          Source: global trafficTCP traffic: 192.168.2.12:62491 -> 60.36.166.193:587
          Source: global trafficTCP traffic: 192.168.2.12:62492 -> 169.46.207.84:587
          Source: global trafficTCP traffic: 192.168.2.12:62494 -> 142.250.150.27:587
          Source: global trafficTCP traffic: 192.168.2.12:62495 -> 77.75.77.165:587
          Source: global trafficTCP traffic: 192.168.2.12:62496 -> 212.101.122.34:587
          Source: global trafficTCP traffic: 192.168.2.12:62497 -> 149.28.227.54:587
          Source: global trafficTCP traffic: 192.168.2.12:62498 -> 167.99.248.199:587
          Source: global trafficTCP traffic: 192.168.2.12:62499 -> 191.252.112.195:587
          Source: global trafficTCP traffic: 192.168.2.12:62500 -> 185.151.30.199:587
          Source: global trafficTCP traffic: 192.168.2.12:62501 -> 2.207.150.234:587
          Source: global trafficTCP traffic: 192.168.2.12:62503 -> 65.109.49.216:587
          Source: global trafficTCP traffic: 192.168.2.12:56912 -> 134.153.136.52:587
          Source: global trafficTCP traffic: 192.168.2.12:56913 -> 34.246.241.220:587
          Source: global trafficTCP traffic: 192.168.2.12:56917 -> 42.112.58.212:587
          Source: global trafficTCP traffic: 192.168.2.12:56918 -> 52.101.9.26:587
          Source: global trafficTCP traffic: 192.168.2.12:56919 -> 199.85.66.2:587
          Source: global trafficTCP traffic: 192.168.2.12:56922 -> 195.110.124.148:587
          Source: global trafficTCP traffic: 192.168.2.12:56924 -> 212.227.15.41:587
          Source: global trafficTCP traffic: 192.168.2.12:56925 -> 124.153.64.203:587
          Source: global trafficTCP traffic: 192.168.2.12:56928 -> 40.85.218.2:587
          Source: global trafficTCP traffic: 192.168.2.12:56931 -> 91.195.240.12:587
          Source: global trafficTCP traffic: 192.168.2.12:56932 -> 194.158.122.55:587
          Source: global trafficTCP traffic: 192.168.2.12:56934 -> 207.246.115.231:2525
          Source: global trafficTCP traffic: 192.168.2.12:56935 -> 13.248.169.48:587
          Source: global trafficTCP traffic: 192.168.2.12:56941 -> 89.236.174.10:587
          Source: global trafficTCP traffic: 192.168.2.12:56944 -> 205.228.15.13:587
          Source: global trafficTCP traffic: 192.168.2.12:56945 -> 104.18.2.81:587
          Source: global trafficTCP traffic: 192.168.2.12:56946 -> 67.219.246.221:587
          Source: global trafficTCP traffic: 192.168.2.12:56947 -> 129.159.110.135:587
          Source: global trafficTCP traffic: 192.168.2.12:56948 -> 194.19.134.86:587
          Source: global trafficTCP traffic: 192.168.2.12:56950 -> 45.56.79.23:587
          Source: global trafficTCP traffic: 192.168.2.12:56951 -> 52.63.237.70:587
          Source: global trafficTCP traffic: 192.168.2.12:56954 -> 193.201.172.98:587
          Source: global trafficTCP traffic: 192.168.2.12:56955 -> 60.36.166.184:587
          Source: global trafficTCP traffic: 192.168.2.12:56956 -> 99.83.253.192:587
          Source: global trafficTCP traffic: 192.168.2.12:56958 -> 84.116.6.3:587
          Source: global trafficTCP traffic: 192.168.2.12:56959 -> 13.55.34.108:587
          Source: global trafficTCP traffic: 192.168.2.12:56960 -> 199.59.243.228:587
          Source: global trafficTCP traffic: 192.168.2.12:56965 -> 195.138.80.34:587
          Source: global trafficTCP traffic: 192.168.2.12:56966 -> 15.72.64.135:587
          Source: global trafficTCP traffic: 192.168.2.12:56967 -> 107.190.138.50:587
          Source: global trafficTCP traffic: 192.168.2.12:56971 -> 78.46.117.76:587
          Source: global trafficTCP traffic: 192.168.2.12:56972 -> 64.136.44.40:587
          Source: global trafficTCP traffic: 192.168.2.12:56973 -> 185.138.56.213:587
          Source: global trafficTCP traffic: 192.168.2.12:56974 -> 104.21.112.1:587
          Source: global trafficTCP traffic: 192.168.2.12:56975 -> 195.32.69.33:587
          Source: global trafficTCP traffic: 192.168.2.12:56976 -> 74.125.200.26:587
          Source: global trafficTCP traffic: 192.168.2.12:56977 -> 151.101.1.193:587
          Source: global trafficTCP traffic: 192.168.2.12:56978 -> 104.131.176.42:587
          Source: global trafficTCP traffic: 192.168.2.12:56979 -> 51.81.206.109:587
          Source: global trafficTCP traffic: 192.168.2.12:56981 -> 84.2.43.67:587
          Source: global trafficTCP traffic: 192.168.2.12:56983 -> 146.75.118.114:587
          Source: global trafficTCP traffic: 192.168.2.12:56987 -> 185.53.178.51:587
          Source: global trafficTCP traffic: 192.168.2.12:56988 -> 67.205.17.103:587
          Source: global trafficTCP traffic: 192.168.2.12:56989 -> 187.85.164.163:587
          Source: global trafficTCP traffic: 192.168.2.12:56990 -> 52.96.125.66:587
          Source: global trafficTCP traffic: 192.168.2.12:56991 -> 170.10.150.242:587
          Source: global trafficTCP traffic: 192.168.2.12:56992 -> 62.149.128.151:587
          Source: global trafficTCP traffic: 192.168.2.12:56994 -> 65.20.63.172:587
          Source: global trafficTCP traffic: 192.168.2.12:56997 -> 142.222.6.191:587
          Source: global trafficTCP traffic: 192.168.2.12:56999 -> 194.153.145.104:587
          Source: global trafficTCP traffic: 192.168.2.12:57001 -> 66.234.112.67:587
          Source: global trafficTCP traffic: 192.168.2.12:57003 -> 160.251.102.56:587
          Source: global trafficTCP traffic: 192.168.2.12:57005 -> 194.145.247.36:587
          Source: global trafficTCP traffic: 192.168.2.12:57008 -> 120.50.131.112:587
          Source: global trafficTCP traffic: 192.168.2.12:57012 -> 195.130.131.33:587
          Source: global trafficTCP traffic: 192.168.2.12:57014 -> 162.210.196.167:587
          Source: global trafficTCP traffic: 192.168.2.12:57015 -> 8.210.167.147:587
          Source: global trafficTCP traffic: 192.168.2.12:57017 -> 81.236.63.162:587
          Source: global trafficTCP traffic: 192.168.2.12:57021 -> 62.149.128.202:587
          Source: global trafficTCP traffic: 192.168.2.12:57022 -> 103.173.250.2:587
          Source: global trafficTCP traffic: 192.168.2.12:57025 -> 185.185.170.37:587
          Source: global trafficTCP traffic: 192.168.2.12:57027 -> 217.160.233.72:587
          Source: global trafficTCP traffic: 192.168.2.12:57029 -> 200.144.248.41:587
          Source: global trafficTCP traffic: 192.168.2.12:57030 -> 69.46.28.43:587
          Source: global trafficTCP traffic: 192.168.2.12:57034 -> 194.25.134.110:587
          Source: global trafficTCP traffic: 192.168.2.12:57035 -> 23.227.38.70:587
          Source: global trafficTCP traffic: 192.168.2.12:57039 -> 130.69.92.10:587
          Source: global trafficTCP traffic: 192.168.2.12:57040 -> 51.159.138.107:587
          Source: global trafficTCP traffic: 192.168.2.12:57045 -> 222.15.69.195:587
          Source: global trafficTCP traffic: 192.168.2.12:57053 -> 194.152.32.10:587
          Source: global trafficTCP traffic: 192.168.2.12:57054 -> 185.138.56.194:587
          Source: global trafficTCP traffic: 192.168.2.12:57056 -> 77.75.78.196:587
          Source: global trafficTCP traffic: 192.168.2.12:57057 -> 202.172.28.128:587
          Source: global trafficTCP traffic: 192.168.2.12:57059 -> 216.29.225.176:587
          Source: global trafficTCP traffic: 192.168.2.12:57060 -> 63.135.176.5:587
          Source: global trafficTCP traffic: 192.168.2.12:57061 -> 217.160.0.40:587
          Source: global trafficTCP traffic: 192.168.2.12:57063 -> 104.21.16.1:587
          Source: global trafficTCP traffic: 192.168.2.12:57065 -> 86.43.151.3:587
          Source: global trafficTCP traffic: 192.168.2.12:57067 -> 87.98.160.167:587
          Source: global trafficTCP traffic: 192.168.2.12:57068 -> 3.33.130.190:587
          Source: global trafficTCP traffic: 192.168.2.12:57070 -> 64.29.145.194:587
          Source: global trafficTCP traffic: 192.168.2.12:57072 -> 199.235.124.212:587
          Source: global trafficTCP traffic: 192.168.2.12:57073 -> 117.53.114.15:587
          Source: global trafficTCP traffic: 192.168.2.12:57074 -> 96.99.227.0:587
          Source: global trafficTCP traffic: 192.168.2.12:57078 -> 194.63.249.216:587
          Source: global trafficTCP traffic: 192.168.2.12:57081 -> 69.195.119.116:587
          Source: global trafficTCP traffic: 192.168.2.12:57082 -> 52.92.20.188:587
          Source: global trafficTCP traffic: 192.168.2.12:57085 -> 138.246.224.218:587
          Source: global trafficTCP traffic: 192.168.2.12:57087 -> 103.228.17.25:587
          Source: global trafficTCP traffic: 192.168.2.12:53337 -> 180.37.199.210:587
          Source: global trafficTCP traffic: 192.168.2.12:53341 -> 149.202.135.9:587
          Source: global trafficTCP traffic: 192.168.2.12:53345 -> 62.101.76.218:587
          Source: global trafficTCP traffic: 192.168.2.12:53347 -> 13.33.187.22:587
          Source: global trafficTCP traffic: 192.168.2.12:53351 -> 180.37.199.181:587
          Source: global trafficTCP traffic: 192.168.2.12:53356 -> 17.253.142.4:587
          Source: global trafficTCP traffic: 192.168.2.12:53357 -> 142.250.153.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53359 -> 207.115.66.179:587
          Source: global trafficTCP traffic: 192.168.2.12:53366 -> 87.248.97.31:587
          Source: global trafficTCP traffic: 192.168.2.12:53367 -> 52.169.73.236:587
          Source: global trafficTCP traffic: 192.168.2.12:53369 -> 199.60.103.37:587
          Source: global trafficTCP traffic: 192.168.2.12:53371 -> 103.20.202.129:587
          Source: global trafficTCP traffic: 192.168.2.12:53372 -> 195.110.124.188:587
          Source: global trafficTCP traffic: 192.168.2.12:53377 -> 17.42.251.41:587
          Source: global trafficTCP traffic: 192.168.2.12:53379 -> 194.105.166.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53381 -> 194.185.246.171:587
          Source: global trafficTCP traffic: 192.168.2.12:53383 -> 133.237.129.136:587
          Source: global trafficTCP traffic: 192.168.2.12:53386 -> 77.75.77.222:587
          Source: global trafficTCP traffic: 192.168.2.12:53388 -> 62.129.239.251:587
          Source: global trafficTCP traffic: 192.168.2.12:53390 -> 62.149.128.201:587
          Source: global trafficTCP traffic: 192.168.2.12:53391 -> 148.163.143.241:587
          Source: global trafficTCP traffic: 192.168.2.12:53395 -> 81.169.145.97:587
          Source: global trafficTCP traffic: 192.168.2.12:53398 -> 64.91.253.60:587
          Source: global trafficTCP traffic: 192.168.2.12:53399 -> 193.122.179.25:587
          Source: global trafficTCP traffic: 192.168.2.12:53400 -> 77.221.39.216:587
          Source: global trafficTCP traffic: 192.168.2.12:53401 -> 183.111.138.176:587
          Source: global trafficTCP traffic: 192.168.2.12:53406 -> 211.249.221.105:587
          Source: global trafficTCP traffic: 192.168.2.12:53407 -> 34.102.212.0:587
          Source: global trafficTCP traffic: 192.168.2.12:53408 -> 142.250.186.51:587
          Source: global trafficTCP traffic: 192.168.2.12:53410 -> 199.224.64.207:587
          Source: global trafficTCP traffic: 192.168.2.12:53411 -> 85.236.153.201:587
          Source: global trafficTCP traffic: 192.168.2.12:53412 -> 183.181.85.107:587
          Source: global trafficTCP traffic: 192.168.2.12:53413 -> 139.134.5.153:587
          Source: global trafficTCP traffic: 192.168.2.12:53415 -> 213.209.1.147:587
          Source: global trafficTCP traffic: 192.168.2.12:53417 -> 5.35.226.210:587
          Source: global trafficTCP traffic: 192.168.2.12:53418 -> 195.130.132.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53424 -> 94.100.132.47:587
          Source: global trafficTCP traffic: 192.168.2.12:53427 -> 34.111.176.156:587
          Source: global trafficTCP traffic: 192.168.2.12:53429 -> 80.158.67.40:587
          Source: global trafficTCP traffic: 192.168.2.12:53434 -> 204.74.99.100:587
          Source: global trafficTCP traffic: 192.168.2.12:53436 -> 195.216.236.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53437 -> 66.29.137.15:587
          Source: global trafficTCP traffic: 192.168.2.12:53440 -> 66.159.240.41:587
          Source: global trafficTCP traffic: 192.168.2.12:53442 -> 112.78.125.109:587
          Source: global trafficTCP traffic: 192.168.2.12:53444 -> 213.209.1.146:587
          Source: global trafficTCP traffic: 192.168.2.12:53448 -> 45.60.134.168:587
          Source: global trafficTCP traffic: 192.168.2.12:53449 -> 216.98.197.3:587
          Source: global trafficTCP traffic: 192.168.2.12:53454 -> 212.7.147.128:587
          Source: global trafficTCP traffic: 192.168.2.12:53455 -> 168.0.132.203:587
          Source: global trafficTCP traffic: 192.168.2.12:53456 -> 59.157.128.15:587
          Source: global trafficTCP traffic: 192.168.2.12:53458 -> 52.18.216.171:587
          Source: global trafficTCP traffic: 192.168.2.12:53460 -> 85.13.149.138:587
          Source: global trafficTCP traffic: 192.168.2.12:53461 -> 205.220.160.150:587
          Source: global trafficTCP traffic: 192.168.2.12:53462 -> 175.135.252.193:587
          Source: global trafficTCP traffic: 192.168.2.12:53465 -> 80.48.169.1:587
          Source: global trafficTCP traffic: 192.168.2.12:53471 -> 62.104.23.16:587
          Source: global trafficTCP traffic: 192.168.2.12:53472 -> 185.151.30.160:587
          Source: global trafficTCP traffic: 192.168.2.12:53474 -> 187.6.211.40:587
          Source: global trafficTCP traffic: 192.168.2.12:53479 -> 72.167.67.229:587
          Source: global trafficTCP traffic: 192.168.2.12:53480 -> 54.236.189.61:587
          Source: global trafficTCP traffic: 192.168.2.12:53491 -> 38.55.13.75:587
          Source: global trafficTCP traffic: 192.168.2.12:53497 -> 80.91.55.62:587
          Source: global trafficTCP traffic: 192.168.2.12:53499 -> 142.250.185.147:587
          Source: global trafficTCP traffic: 192.168.2.12:53500 -> 142.250.185.83:587
          Source: global trafficTCP traffic: 192.168.2.12:53501 -> 208.91.197.39:587
          Source: global trafficTCP traffic: 192.168.2.12:53503 -> 119.205.215.249:587
          Source: global trafficTCP traffic: 192.168.2.12:53504 -> 52.60.87.163:587
          Source: global trafficTCP traffic: 192.168.2.12:53507 -> 205.220.173.171:2525
          Source: global trafficTCP traffic: 192.168.2.12:53517 -> 206.213.211.176:587
          Source: global trafficTCP traffic: 192.168.2.12:53519 -> 13.107.213.43:587
          Source: global trafficTCP traffic: 192.168.2.12:53525 -> 198.12.234.215:587
          Source: global trafficTCP traffic: 192.168.2.12:53528 -> 93.17.128.165:587
          Source: global trafficTCP traffic: 192.168.2.12:53529 -> 208.91.199.225:587
          Source: global trafficTCP traffic: 192.168.2.12:53531 -> 213.205.32.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53532 -> 213.168.87.11:587
          Source: global trafficTCP traffic: 192.168.2.12:53536 -> 217.160.0.179:587
          Source: global trafficTCP traffic: 192.168.2.12:53537 -> 210.151.38.80:587
          Source: global trafficTCP traffic: 192.168.2.12:53542 -> 159.134.198.135:587
          Source: global trafficTCP traffic: 192.168.2.12:53546 -> 212.11.228.67:587
          Source: global trafficTCP traffic: 192.168.2.12:53549 -> 43.245.43.88:587
          Source: global trafficTCP traffic: 192.168.2.12:53550 -> 37.97.231.106:587
          Source: global trafficTCP traffic: 192.168.2.12:53551 -> 152.74.16.8:587
          Source: global trafficTCP traffic: 192.168.2.12:53552 -> 76.223.84.192:587
          Source: global trafficTCP traffic: 192.168.2.12:53554 -> 164.70.78.188:587
          Source: global trafficTCP traffic: 192.168.2.12:53555 -> 99.83.190.102:587
          Source: global trafficTCP traffic: 192.168.2.12:53556 -> 209.71.208.6:587
          Source: global trafficTCP traffic: 192.168.2.12:53560 -> 90.216.128.5:587
          Source: global trafficTCP traffic: 192.168.2.12:53561 -> 35.213.174.122:587
          Source: global trafficTCP traffic: 192.168.2.12:53563 -> 195.130.132.9:587
          Source: global trafficTCP traffic: 192.168.2.12:53567 -> 193.81.82.81:587
          Source: global trafficTCP traffic: 192.168.2.12:53575 -> 202.177.34.74:587
          Source: global trafficTCP traffic: 192.168.2.12:53576 -> 104.18.9.233:587
          Source: global trafficTCP traffic: 192.168.2.12:53577 -> 15.204.43.61:587
          Source: global trafficTCP traffic: 192.168.2.12:53578 -> 108.138.26.35:587
          Source: global trafficTCP traffic: 192.168.2.12:53582 -> 64.59.136.142:587
          Source: global trafficTCP traffic: 192.168.2.12:53587 -> 114.179.184.189:587
          Source: global trafficTCP traffic: 192.168.2.12:53588 -> 52.218.92.180:587
          Source: global trafficTCP traffic: 192.168.2.12:53590 -> 117.18.152.49:587
          Source: global trafficTCP traffic: 192.168.2.12:53594 -> 195.238.22.30:587
          Source: global trafficTCP traffic: 192.168.2.12:53595 -> 92.205.149.199:587
          Source: global trafficTCP traffic: 192.168.2.12:53596 -> 217.70.36.87:587
          Source: global trafficTCP traffic: 192.168.2.12:53600 -> 167.206.237.230:587
          Source: global trafficTCP traffic: 192.168.2.12:53601 -> 41.76.108.130:587
          Source: global trafficTCP traffic: 192.168.2.12:53612 -> 142.250.150.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53613 -> 67.20.76.169:587
          Source: global trafficTCP traffic: 192.168.2.12:53614 -> 204.74.99.103:587
          Source: global trafficTCP traffic: 192.168.2.12:53615 -> 185.230.212.166:587
          Source: global trafficTCP traffic: 192.168.2.12:53618 -> 129.226.106.19:587
          Source: global trafficTCP traffic: 192.168.2.12:53623 -> 68.70.190.2:587
          Source: global trafficTCP traffic: 192.168.2.12:53626 -> 93.43.63.118:587
          Source: global trafficTCP traffic: 192.168.2.12:53630 -> 213.171.216.50:587
          Source: global trafficTCP traffic: 192.168.2.12:53633 -> 91.136.8.175:587
          Source: global trafficTCP traffic: 192.168.2.12:53634 -> 167.89.118.83:587
          Source: global trafficTCP traffic: 192.168.2.12:53635 -> 5.9.69.91:587
          Source: global trafficTCP traffic: 192.168.2.12:53637 -> 76.223.105.230:587
          Source: global trafficTCP traffic: 192.168.2.12:53638 -> 69.195.78.221:587
          Source: global trafficTCP traffic: 192.168.2.12:53640 -> 62.149.128.40:587
          Source: global trafficTCP traffic: 192.168.2.12:53642 -> 103.240.88.13:587
          Source: global trafficTCP traffic: 192.168.2.12:53643 -> 142.93.237.125:587
          Source: global trafficTCP traffic: 192.168.2.12:53649 -> 209.202.254.90:587
          Source: global trafficTCP traffic: 192.168.2.12:53659 -> 94.102.214.226:587
          Source: global trafficTCP traffic: 192.168.2.12:53663 -> 142.251.5.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53665 -> 104.18.4.230:587
          Source: global trafficTCP traffic: 192.168.2.12:53666 -> 43.250.142.67:587
          Source: global trafficTCP traffic: 192.168.2.12:53667 -> 162.159.133.90:587
          Source: global trafficTCP traffic: 192.168.2.12:53668 -> 87.238.28.12:587
          Source: global trafficTCP traffic: 192.168.2.12:53669 -> 35.168.64.20:587
          Source: global trafficTCP traffic: 192.168.2.12:53672 -> 67.231.149.213:587
          Source: global trafficTCP traffic: 192.168.2.12:53674 -> 59.157.130.138:587
          Source: global trafficTCP traffic: 192.168.2.12:53678 -> 62.142.5.237:587
          Source: global trafficTCP traffic: 192.168.2.12:53679 -> 200.34.200.231:587
          Source: global trafficTCP traffic: 192.168.2.12:53681 -> 23.88.34.196:587
          Source: global trafficTCP traffic: 192.168.2.12:53686 -> 175.135.252.195:587
          Source: global trafficTCP traffic: 192.168.2.12:53687 -> 64.90.62.162:587
          Source: global trafficTCP traffic: 192.168.2.12:53689 -> 62.149.188.200:587
          Source: global trafficTCP traffic: 192.168.2.12:53693 -> 89.38.148.142:587
          Source: global trafficTCP traffic: 192.168.2.12:53694 -> 64.190.63.222:587
          Source: global trafficTCP traffic: 192.168.2.12:53698 -> 180.37.199.33:587
          Source: global trafficTCP traffic: 192.168.2.12:53701 -> 13.248.158.7:587
          Source: global trafficTCP traffic: 192.168.2.12:53702 -> 117.50.20.113:587
          Source: global trafficTCP traffic: 192.168.2.12:53705 -> 104.18.43.152:2525
          Source: global trafficTCP traffic: 192.168.2.12:53710 -> 188.165.36.237:587
          Source: global trafficTCP traffic: 192.168.2.12:53712 -> 210.131.2.36:587
          Source: global trafficTCP traffic: 192.168.2.12:53716 -> 123.57.253.119:587
          Source: global trafficTCP traffic: 192.168.2.12:53721 -> 198.185.159.144:587
          Source: global trafficTCP traffic: 192.168.2.12:53035 -> 64.98.38.4:587
          Source: global trafficTCP traffic: 192.168.2.12:53038 -> 208.28.90.228:587
          Source: global trafficTCP traffic: 192.168.2.12:53040 -> 41.193.157.227:587
          Source: global trafficTCP traffic: 192.168.2.12:53044 -> 142.250.181.238:587
          Source: global trafficTCP traffic: 192.168.2.12:53048 -> 85.13.128.49:587
          Source: global trafficTCP traffic: 192.168.2.12:53062 -> 89.238.73.103:587
          Source: global trafficTCP traffic: 192.168.2.12:53063 -> 195.121.65.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53069 -> 101.50.87.231:587
          Source: global trafficTCP traffic: 192.168.2.12:53070 -> 217.160.72.6:587
          Source: global trafficTCP traffic: 192.168.2.12:59683 -> 216.150.240.141:587
          Source: global trafficTCP traffic: 192.168.2.12:59686 -> 62.146.106.50:587
          Source: global trafficTCP traffic: 192.168.2.12:59689 -> 185.76.64.29:587
          Source: global trafficTCP traffic: 192.168.2.12:59694 -> 3.125.131.179:587
          Source: global trafficTCP traffic: 192.168.2.12:59695 -> 151.164.129.2:587
          Source: global trafficTCP traffic: 192.168.2.12:59699 -> 206.188.192.242:587
          Source: global trafficTCP traffic: 192.168.2.12:59700 -> 216.71.129.20:587
          Source: global trafficTCP traffic: 192.168.2.12:59701 -> 91.235.52.77:587
          Source: global trafficTCP traffic: 192.168.2.12:59702 -> 167.172.23.243:587
          Source: global trafficTCP traffic: 192.168.2.12:59703 -> 217.182.102.160:587
          Source: global trafficTCP traffic: 192.168.2.12:59707 -> 62.103.146.102:587
          Source: global trafficTCP traffic: 192.168.2.12:59711 -> 38.210.213.88:587
          Source: global trafficTCP traffic: 192.168.2.12:59715 -> 198.164.4.15:587
          Source: global trafficTCP traffic: 192.168.2.12:59718 -> 85.93.219.12:587
          Source: global trafficTCP traffic: 192.168.2.12:59725 -> 82.113.237.91:587
          Source: global trafficTCP traffic: 192.168.2.12:59726 -> 180.37.199.26:587
          Source: global trafficTCP traffic: 192.168.2.12:59727 -> 190.225.183.42:587
          Source: global trafficTCP traffic: 192.168.2.12:59728 -> 15.197.134.120:587
          Source: global trafficTCP traffic: 192.168.2.12:59729 -> 193.239.248.167:587
          Source: global trafficTCP traffic: 192.168.2.12:59730 -> 140.227.93.96:587
          Source: global trafficTCP traffic: 192.168.2.12:59733 -> 54.84.180.161:587
          Source: global trafficTCP traffic: 192.168.2.12:59736 -> 219.90.66.200:587
          Source: global trafficTCP traffic: 192.168.2.12:59737 -> 52.18.59.124:587
          Source: global trafficTCP traffic: 192.168.2.12:59742 -> 194.72.80.196:587
          Source: global trafficTCP traffic: 192.168.2.12:59747 -> 45.82.189.130:587
          Source: global trafficTCP traffic: 192.168.2.12:59750 -> 103.226.222.162:587
          Source: global trafficTCP traffic: 192.168.2.12:59751 -> 60.36.166.235:587
          Source: global trafficTCP traffic: 192.168.2.12:59754 -> 185.46.229.190:587
          Source: global trafficTCP traffic: 192.168.2.12:59762 -> 23.37.55.159:587
          Source: global trafficTCP traffic: 192.168.2.12:59763 -> 15.197.225.128:587
          Source: global trafficTCP traffic: 192.168.2.12:59764 -> 66.96.132.61:587
          Source: global trafficTCP traffic: 192.168.2.12:59765 -> 52.193.247.45:587
          Source: global trafficTCP traffic: 192.168.2.12:59766 -> 195.8.66.22:587
          Source: global trafficTCP traffic: 192.168.2.12:59768 -> 103.6.199.109:587
          Source: global trafficTCP traffic: 192.168.2.12:54587 -> 82.144.228.4:587
          Source: global trafficTCP traffic: 192.168.2.12:54591 -> 80.67.172.22:587
          Source: global trafficTCP traffic: 192.168.2.12:54594 -> 52.101.89.0:587
          Source: global trafficTCP traffic: 192.168.2.12:54597 -> 202.27.184.102:587
          Source: global trafficTCP traffic: 192.168.2.12:54598 -> 13.238.239.16:587
          Source: global trafficTCP traffic: 192.168.2.12:54604 -> 212.33.194.58:587
          Source: global trafficTCP traffic: 192.168.2.12:54605 -> 185.230.63.107:587
          Source: global trafficTCP traffic: 192.168.2.12:54608 -> 155.231.208.2:587
          Source: global trafficTCP traffic: 192.168.2.12:54614 -> 194.25.225.136:587
          Source: global trafficTCP traffic: 192.168.2.12:54619 -> 60.36.166.219:587
          Source: global trafficTCP traffic: 192.168.2.12:54620 -> 175.135.253.3:587
          Source: global trafficTCP traffic: 192.168.2.12:54625 -> 162.255.118.7:587
          Source: global trafficTCP traffic: 192.168.2.12:54626 -> 210.166.222.44:587
          Source: global trafficTCP traffic: 192.168.2.12:54627 -> 216.40.42.189:587
          Source: global trafficTCP traffic: 192.168.2.12:54628 -> 69.195.88.144:587
          Source: global trafficTCP traffic: 192.168.2.12:54631 -> 128.100.132.104:587
          Source: global trafficTCP traffic: 192.168.2.12:54635 -> 37.61.245.7:587
          Source: global trafficTCP traffic: 192.168.2.12:54781 -> 18.205.78.10:587
          Source: global trafficTCP traffic: 192.168.2.12:54782 -> 52.64.198.206:587
          Source: global trafficTCP traffic: 192.168.2.12:54788 -> 188.40.120.147:587
          Source: global trafficTCP traffic: 192.168.2.12:54789 -> 164.124.141.203:587
          Source: global trafficTCP traffic: 192.168.2.12:54794 -> 104.102.59.175:587
          Source: global trafficTCP traffic: 192.168.2.12:54796 -> 46.30.215.149:587
          Source: global trafficTCP traffic: 192.168.2.12:54799 -> 129.213.180.114:587
          Source: global trafficTCP traffic: 192.168.2.12:54829 -> 134.151.36.50:587
          Source: global trafficTCP traffic: 192.168.2.12:54836 -> 62.149.128.166:587
          Source: global trafficTCP traffic: 192.168.2.12:54840 -> 195.249.151.222:587
          Source: global trafficTCP traffic: 192.168.2.12:54844 -> 209.17.116.160:587
          Source: global trafficTCP traffic: 192.168.2.12:54845 -> 149.97.246.199:587
          Source: global trafficTCP traffic: 192.168.2.12:50458 -> 141.94.139.121:587
          Source: global trafficTCP traffic: 192.168.2.12:50459 -> 212.135.1.103:587
          Source: global trafficTCP traffic: 192.168.2.12:50465 -> 180.37.199.143:587
          Source: global trafficTCP traffic: 192.168.2.12:50467 -> 147.67.34.30:587
          Source: global trafficTCP traffic: 192.168.2.12:50468 -> 185.187.81.214:587
          Source: global trafficTCP traffic: 192.168.2.12:50473 -> 200.40.52.164:587
          Source: global trafficTCP traffic: 192.168.2.12:50479 -> 110.4.46.117:587
          Source: global trafficTCP traffic: 192.168.2.12:50483 -> 209.222.82.255:587
          Source: global trafficTCP traffic: 192.168.2.12:50484 -> 86.109.167.69:587
          Source: global trafficTCP traffic: 192.168.2.12:50487 -> 52.101.68.15:587
          Source: global trafficTCP traffic: 192.168.2.12:50493 -> 65.87.230.8:587
          Source: global trafficTCP traffic: 192.168.2.12:50494 -> 208.91.196.152:587
          Source: global trafficTCP traffic: 192.168.2.12:50498 -> 202.224.54.66:587
          Source: global trafficTCP traffic: 192.168.2.12:50499 -> 79.170.40.147:587
          Source: global trafficTCP traffic: 192.168.2.12:50504 -> 208.91.197.27:587
          Source: global trafficTCP traffic: 192.168.2.12:62545 -> 203.249.96.35:587
          Source: global trafficTCP traffic: 192.168.2.12:62549 -> 186.192.83.12:587
          Source: global trafficTCP traffic: 192.168.2.12:62550 -> 52.20.84.62:587
          Source: global trafficTCP traffic: 192.168.2.12:62555 -> 108.184.162.115:587
          Source: global trafficTCP traffic: 192.168.2.12:62561 -> 94.100.136.8:587
          Source: global trafficTCP traffic: 192.168.2.12:62562 -> 64.18.172.220:587
          Source: global trafficTCP traffic: 192.168.2.12:62570 -> 217.198.120.97:587
          Source: global trafficTCP traffic: 192.168.2.12:62571 -> 75.126.100.12:587
          Source: global trafficTCP traffic: 192.168.2.12:62576 -> 183.90.250.34:587
          Source: global trafficTCP traffic: 192.168.2.12:62580 -> 103.224.182.251:587
          Source: global trafficTCP traffic: 192.168.2.12:62581 -> 104.22.65.144:587
          Source: global trafficTCP traffic: 192.168.2.12:62584 -> 203.249.96.80:587
          Source: global trafficTCP traffic: 192.168.2.12:62585 -> 119.252.155.19:587
          Source: global trafficTCP traffic: 192.168.2.12:62586 -> 194.254.242.35:587
          Source: global trafficTCP traffic: 192.168.2.12:62589 -> 52.218.108.60:587
          Source: global trafficTCP traffic: 192.168.2.12:62593 -> 150.214.204.23:587
          Source: global trafficTCP traffic: 192.168.2.12:62598 -> 27.120.211.44:587
          Source: global trafficTCP traffic: 192.168.2.12:62603 -> 3.33.133.19:587
          Source: global trafficTCP traffic: 192.168.2.12:54475 -> 54.38.201.205:587
          Source: global trafficTCP traffic: 192.168.2.12:54478 -> 216.69.141.86:587
          Source: global trafficTCP traffic: 192.168.2.12:54483 -> 104.244.126.243:587
          Source: global trafficTCP traffic: 192.168.2.12:54487 -> 194.106.222.254:587
          Source: global trafficTCP traffic: 192.168.2.12:54491 -> 165.212.120.200:587
          Source: global trafficTCP traffic: 192.168.2.12:55231 -> 209.235.144.9:587
          Source: global trafficTCP traffic: 192.168.2.12:55232 -> 148.163.146.23:587
          Source: global trafficTCP traffic: 192.168.2.12:55233 -> 47.246.146.57:587
          Source: global trafficTCP traffic: 192.168.2.12:55239 -> 193.85.2.14:587
          Source: global trafficTCP traffic: 192.168.2.12:55241 -> 216.71.123.21:587
          Source: global trafficTCP traffic: 192.168.2.12:49638 -> 24.226.22.25:587
          Source: global trafficTCP traffic: 192.168.2.12:49646 -> 131.104.93.93:587
          Source: global trafficTCP traffic: 192.168.2.12:49647 -> 103.20.212.67:587
          Source: global trafficTCP traffic: 192.168.2.12:49652 -> 144.160.235.144:587
          Source: global trafficTCP traffic: 192.168.2.12:49660 -> 35.209.87.79:587
          Source: global trafficTCP traffic: 192.168.2.12:49661 -> 178.208.39.154:587
          Source: global trafficTCP traffic: 192.168.2.12:49662 -> 165.212.65.113:587
          Source: global trafficTCP traffic: 192.168.2.12:49663 -> 45.60.74.41:587
          Source: global trafficTCP traffic: 192.168.2.12:49674 -> 88.150.153.47:587
          Source: global trafficTCP traffic: 192.168.2.12:49675 -> 142.132.181.81:587
          Source: global trafficTCP traffic: 192.168.2.12:51983 -> 195.154.179.117:587
          Source: global trafficTCP traffic: 192.168.2.12:51984 -> 143.167.1.214:587
          Source: global trafficTCP traffic: 192.168.2.12:51986 -> 35.161.243.212:587
          Source: global trafficTCP traffic: 192.168.2.12:51989 -> 103.126.92.253:587
          Source: global trafficTCP traffic: 192.168.2.12:51994 -> 52.218.62.148:587
          Source: global trafficTCP traffic: 192.168.2.12:49406 -> 209.87.239.66:587
          Source: global trafficTCP traffic: 192.168.2.12:49411 -> 38.111.141.40:587
          Source: global trafficTCP traffic: 192.168.2.12:49412 -> 81.0.66.51:587
          Source: global trafficTCP traffic: 192.168.2.12:49421 -> 66.159.233.158:587
          Source: global trafficTCP traffic: 192.168.2.12:49422 -> 180.37.194.38:587
          Source: global trafficTCP traffic: 192.168.2.12:49433 -> 143.210.133.109:587
          Source: global trafficTCP traffic: 192.168.2.12:49435 -> 185.97.174.196:587
          Source: global trafficTCP traffic: 192.168.2.12:49436 -> 212.85.97.129:587
          Source: global trafficTCP traffic: 192.168.2.12:51569 -> 167.206.148.154:587
          Source: global trafficTCP traffic: 192.168.2.12:51571 -> 43.246.152.100:587
          Source: global trafficTCP traffic: 192.168.2.12:51577 -> 3.142.71.33:587
          Source: global trafficTCP traffic: 192.168.2.12:51582 -> 142.132.166.12:587
          Source: global trafficTCP traffic: 192.168.2.12:51583 -> 216.17.3.48:587
          Source: global trafficTCP traffic: 192.168.2.12:51585 -> 62.149.128.157:587
          Source: global trafficTCP traffic: 192.168.2.12:51590 -> 160.251.107.179:587
          Source: global trafficTCP traffic: 192.168.2.12:51591 -> 87.106.35.26:587
          Source: global trafficTCP traffic: 192.168.2.12:64234 -> 89.161.255.10:587
          Source: global trafficTCP traffic: 192.168.2.12:64236 -> 200.58.110.204:587
          Source: global trafficTCP traffic: 192.168.2.12:64238 -> 194.78.153.52:587
          Source: global trafficTCP traffic: 192.168.2.12:64240 -> 106.153.227.9:587
          Source: global trafficTCP traffic: 192.168.2.12:64245 -> 170.246.147.62:587
          Source: global trafficTCP traffic: 192.168.2.12:64247 -> 23.7.244.207:587
          Source: global trafficTCP traffic: 192.168.2.12:64253 -> 140.227.104.171:587
          Source: global trafficTCP traffic: 192.168.2.12:64260 -> 203.134.71.82:587
          Source: global trafficTCP traffic: 192.168.2.12:64264 -> 80.237.138.5:587
          Source: global trafficTCP traffic: 192.168.2.12:64268 -> 17.57.155.28:587
          Source: global trafficTCP traffic: 192.168.2.12:64269 -> 94.20.74.2:587
          Source: global trafficTCP traffic: 192.168.2.12:64274 -> 209.67.129.100:587
          Source: global trafficTCP traffic: 192.168.2.12:64275 -> 52.98.18.50:587
          Source: global trafficTCP traffic: 192.168.2.12:64278 -> 134.147.42.237:587
          Source: global trafficTCP traffic: 192.168.2.12:64281 -> 91.212.26.172:587
          Source: global trafficTCP traffic: 192.168.2.12:64282 -> 31.15.10.30:587
          Source: global trafficTCP traffic: 192.168.2.12:64287 -> 137.74.0.55:587
          Source: global trafficTCP traffic: 192.168.2.12:64300 -> 104.18.235.36:587
          Source: global trafficTCP traffic: 192.168.2.12:64305 -> 217.147.144.66:587
          Source: global trafficTCP traffic: 192.168.2.12:64310 -> 67.69.168.9:587
          Source: global trafficTCP traffic: 192.168.2.12:64313 -> 85.233.160.22:587
          Source: global trafficTCP traffic: 192.168.2.12:64318 -> 3.5.67.244:587
          Source: global trafficTCP traffic: 192.168.2.12:49978 -> 45.239.111.63:587
          Source: global trafficTCP traffic: 192.168.2.12:49982 -> 193.74.71.25:587
          Source: global trafficTCP traffic: 192.168.2.12:49983 -> 103.224.182.240:587
          Source: global trafficTCP traffic: 192.168.2.12:49985 -> 195.10.232.21:587
          Source: global trafficTCP traffic: 192.168.2.12:49991 -> 209.240.204.200:587
          Source: global trafficTCP traffic: 192.168.2.12:49998 -> 128.176.6.221:587
          Source: global trafficTCP traffic: 192.168.2.12:50002 -> 207.115.69.27:587
          Source: global trafficTCP traffic: 192.168.2.12:50003 -> 202.212.219.44:587
          Source: global trafficTCP traffic: 192.168.2.12:50012 -> 80.158.66.24:587
          Source: global trafficTCP traffic: 192.168.2.12:50015 -> 54.147.36.126:587
          Source: global trafficTCP traffic: 192.168.2.12:50028 -> 176.235.24.54:587
          Source: global trafficTCP traffic: 192.168.2.12:63964 -> 139.95.6.107:587
          Source: global trafficTCP traffic: 192.168.2.12:63975 -> 106.187.245.236:587
          Source: global trafficTCP traffic: 192.168.2.12:63978 -> 202.138.49.32:587
          Source: global trafficTCP traffic: 192.168.2.12:63981 -> 217.76.146.62:587
          Source: global trafficTCP traffic: 192.168.2.12:63983 -> 140.238.130.31:587
          Source: global trafficTCP traffic: 192.168.2.12:63989 -> 46.51.204.184:587
          Source: global trafficTCP traffic: 192.168.2.12:63990 -> 92.204.41.31:587
          Source: global trafficTCP traffic: 192.168.2.12:63992 -> 211.29.132.105:587
          Source: global trafficTCP traffic: 192.168.2.12:63997 -> 112.78.112.152:587
          Source: global trafficTCP traffic: 192.168.2.12:53235 -> 199.224.64.206:587
          Source: global trafficTCP traffic: 192.168.2.12:56891 -> 195.110.124.133:587
          Source: global trafficTCP traffic: 192.168.2.12:56894 -> 104.18.3.81:587
          Source: global trafficTCP traffic: 192.168.2.12:56895 -> 209.216.88.85:587
          Source: global trafficTCP traffic: 192.168.2.12:56896 -> 200.33.202.70:587
          Source: global trafficTCP traffic: 192.168.2.12:56900 -> 74.208.5.21:587
          Source: global trafficTCP traffic: 192.168.2.12:56903 -> 20.43.132.130:587
          Source: global trafficTCP traffic: 192.168.2.12:56904 -> 83.143.217.131:587
          Source: global trafficTCP traffic: 192.168.2.12:56912 -> 98.159.192.194:587
          Source: global trafficTCP traffic: 192.168.2.12:56916 -> 170.33.13.246:587
          Source: global trafficTCP traffic: 192.168.2.12:56917 -> 217.160.0.155:587
          Source: global trafficTCP traffic: 192.168.2.12:56937 -> 195.171.90.198:587
          Source: global trafficTCP traffic: 192.168.2.12:56981 -> 46.17.173.222:587
          Source: global trafficTCP traffic: 192.168.2.12:56985 -> 80.241.60.212:587
          Source: global trafficTCP traffic: 192.168.2.12:56990 -> 13.91.95.74:587
          Source: global trafficTCP traffic: 192.168.2.12:56991 -> 147.182.180.139:587
          Source: global trafficTCP traffic: 192.168.2.12:56996 -> 3.94.41.167:587
          Source: global trafficTCP traffic: 192.168.2.12:57010 -> 207.194.132.144:587
          Source: global trafficTCP traffic: 192.168.2.12:57052 -> 5.153.90.150:587
          Source: global trafficTCP traffic: 192.168.2.12:57057 -> 45.60.75.51:587
          Source: global trafficTCP traffic: 192.168.2.12:57070 -> 51.132.65.86:587
          Source: global trafficTCP traffic: 192.168.2.12:57072 -> 195.254.252.211:587
          Source: global trafficTCP traffic: 192.168.2.12:57073 -> 78.27.225.105:587
          Source: global trafficTCP traffic: 192.168.2.12:57075 -> 80.150.6.143:587
          Source: global trafficTCP traffic: 192.168.2.12:57077 -> 98.83.184.133:587
          Source: global trafficTCP traffic: 192.168.2.12:57110 -> 2.23.209.28:587
          Source: global trafficTCP traffic: 192.168.2.12:57111 -> 212.10.10.65:587
          Source: global trafficTCP traffic: 192.168.2.12:57112 -> 85.10.214.198:587
          Source: global trafficTCP traffic: 192.168.2.12:57113 -> 95.110.169.51:587
          Source: global trafficTCP traffic: 192.168.2.12:57114 -> 207.251.194.110:587
          Source: global trafficTCP traffic: 192.168.2.12:57124 -> 91.121.53.175:587
          Source: global trafficTCP traffic: 192.168.2.12:57125 -> 203.30.46.161:587
          Source: global trafficTCP traffic: 192.168.2.12:57134 -> 203.0.178.48:587
          Source: global trafficTCP traffic: 192.168.2.12:57135 -> 198.12.236.198:587
          Source: global trafficTCP traffic: 192.168.2.12:57137 -> 108.138.26.121:587
          Source: global trafficTCP traffic: 192.168.2.12:57147 -> 128.116.119.4:587
          Source: global trafficTCP traffic: 192.168.2.12:57150 -> 217.160.0.220:587
          Source: global trafficTCP traffic: 192.168.2.12:57156 -> 23.236.62.147:587
          Source: global trafficTCP traffic: 192.168.2.12:57169 -> 46.30.215.60:587
          Source: global trafficTCP traffic: 192.168.2.12:57170 -> 62.156.146.12:587
          Source: global trafficTCP traffic: 192.168.2.12:57171 -> 193.25.197.210:587
          Source: global trafficTCP traffic: 192.168.2.12:57172 -> 64.26.60.229:587
          Source: global trafficTCP traffic: 192.168.2.12:57176 -> 122.146.203.226:587
          Source: global trafficTCP traffic: 192.168.2.12:65035 -> 38.48.180.29:587
          Source: global trafficTCP traffic: 192.168.2.12:65037 -> 34.160.63.108:587
          Source: global trafficTCP traffic: 192.168.2.12:58540 -> 1.1.1.1:53
          Source: global trafficDNS traffic detected: number of DNS queries: 3390
          Source: Joe Sandbox ViewIP Address: 213.186.33.5 213.186.33.5
          Source: Network trafficSuricata IDS: 2012786 - Severity 2 - ET MALWARE DNS Query for Possible FakeAV Domain : 192.168.2.12:64683 -> 1.1.1.1:53
          Source: global trafficTCP traffic: 192.168.2.12:58541 -> 213.209.1.145:587
          Source: global trafficTCP traffic: 192.168.2.12:58542 -> 188.114.97.3:587
          Source: global trafficTCP traffic: 192.168.2.12:58543 -> 193.122.131.100:587
          Source: global trafficTCP traffic: 192.168.2.12:58544 -> 64.59.128.135:587
          Source: global trafficTCP traffic: 192.168.2.12:58545 -> 20.23.151.207:587
          Source: global trafficTCP traffic: 192.168.2.12:58546 -> 13.35.58.117:587
          Source: global trafficTCP traffic: 192.168.2.12:58548 -> 104.19.239.228:587
          Source: global trafficTCP traffic: 192.168.2.12:58549 -> 194.19.134.66:587
          Source: global trafficTCP traffic: 192.168.2.12:58550 -> 104.76.200.128:587
          Source: global trafficTCP traffic: 192.168.2.12:58552 -> 165.160.15.20:587
          Source: global trafficTCP traffic: 192.168.2.12:58553 -> 182.248.170.98:587
          Source: global trafficTCP traffic: 192.168.2.12:58554 -> 142.251.9.26:587
          Source: global trafficTCP traffic: 192.168.2.12:58555 -> 64.136.44.50:587
          Source: global trafficTCP traffic: 192.168.2.12:58556 -> 194.2.0.87:587
          Source: global trafficTCP traffic: 192.168.2.12:62481 -> 130.63.236.137:587
          Source: global trafficTCP traffic: 192.168.2.12:62482 -> 209.38.113.61:25
          Source: global trafficTCP traffic: 192.168.2.12:62483 -> 217.70.178.3:587
          Source: global trafficTCP traffic: 192.168.2.12:62484 -> 52.62.236.135:587
          Source: global trafficTCP traffic: 192.168.2.12:62485 -> 5.183.84.11:587
          Source: global trafficTCP traffic: 192.168.2.12:62486 -> 35.71.162.15:587
          Source: global trafficTCP traffic: 192.168.2.12:62487 -> 35.226.176.186:587
          Source: global trafficTCP traffic: 192.168.2.12:62490 -> 45.33.2.79:587
          Source: global trafficTCP traffic: 192.168.2.12:62491 -> 60.36.166.193:587
          Source: global trafficTCP traffic: 192.168.2.12:62492 -> 169.46.207.84:587
          Source: global trafficTCP traffic: 192.168.2.12:62494 -> 142.250.150.27:587
          Source: global trafficTCP traffic: 192.168.2.12:62495 -> 77.75.77.165:587
          Source: global trafficTCP traffic: 192.168.2.12:62496 -> 212.101.122.34:587
          Source: global trafficTCP traffic: 192.168.2.12:62497 -> 149.28.227.54:587
          Source: global trafficTCP traffic: 192.168.2.12:62498 -> 167.99.248.199:587
          Source: global trafficTCP traffic: 192.168.2.12:62499 -> 191.252.112.195:587
          Source: global trafficTCP traffic: 192.168.2.12:62500 -> 185.151.30.199:587
          Source: global trafficTCP traffic: 192.168.2.12:62501 -> 2.207.150.234:587
          Source: global trafficTCP traffic: 192.168.2.12:62503 -> 65.109.49.216:587
          Source: global trafficTCP traffic: 192.168.2.12:56912 -> 134.153.136.52:587
          Source: global trafficTCP traffic: 192.168.2.12:56913 -> 34.246.241.220:587
          Source: global trafficTCP traffic: 192.168.2.12:56916 -> 143.244.202.96:25
          Source: global trafficTCP traffic: 192.168.2.12:56917 -> 42.112.58.212:587
          Source: global trafficTCP traffic: 192.168.2.12:56918 -> 52.101.9.26:587
          Source: global trafficTCP traffic: 192.168.2.12:56919 -> 199.85.66.2:587
          Source: global trafficTCP traffic: 192.168.2.12:56922 -> 195.110.124.148:587
          Source: global trafficTCP traffic: 192.168.2.12:56924 -> 212.227.15.41:587
          Source: global trafficTCP traffic: 192.168.2.12:56925 -> 124.153.64.203:587
          Source: global trafficTCP traffic: 192.168.2.12:56928 -> 40.85.218.2:587
          Source: global trafficTCP traffic: 192.168.2.12:56931 -> 91.195.240.12:587
          Source: global trafficTCP traffic: 192.168.2.12:56932 -> 194.158.122.55:587
          Source: global trafficTCP traffic: 192.168.2.12:56933 -> 62.241.4.132:25
          Source: global trafficTCP traffic: 192.168.2.12:56935 -> 13.248.169.48:587
          Source: global trafficTCP traffic: 192.168.2.12:56939 -> 195.182.6.70:25
          Source: global trafficTCP traffic: 192.168.2.12:56941 -> 89.236.174.10:587
          Source: global trafficTCP traffic: 192.168.2.12:56944 -> 205.228.15.13:587
          Source: global trafficTCP traffic: 192.168.2.12:56945 -> 104.18.2.81:587
          Source: global trafficTCP traffic: 192.168.2.12:56946 -> 67.219.246.221:587
          Source: global trafficTCP traffic: 192.168.2.12:56947 -> 129.159.110.135:587
          Source: global trafficTCP traffic: 192.168.2.12:56948 -> 194.19.134.86:587
          Source: global trafficTCP traffic: 192.168.2.12:56949 -> 67.231.157.4:25
          Source: global trafficTCP traffic: 192.168.2.12:56950 -> 45.56.79.23:587
          Source: global trafficTCP traffic: 192.168.2.12:56951 -> 52.63.237.70:587
          Source: global trafficTCP traffic: 192.168.2.12:56954 -> 193.201.172.98:587
          Source: global trafficTCP traffic: 192.168.2.12:56955 -> 60.36.166.184:587
          Source: global trafficTCP traffic: 192.168.2.12:56956 -> 99.83.253.192:587
          Source: global trafficTCP traffic: 192.168.2.12:56958 -> 84.116.6.3:587
          Source: global trafficTCP traffic: 192.168.2.12:56959 -> 13.55.34.108:587
          Source: global trafficTCP traffic: 192.168.2.12:56960 -> 199.59.243.228:587
          Source: global trafficTCP traffic: 192.168.2.12:56965 -> 195.138.80.34:587
          Source: global trafficTCP traffic: 192.168.2.12:56966 -> 15.72.64.135:587
          Source: global trafficTCP traffic: 192.168.2.12:56967 -> 107.190.138.50:587
          Source: global trafficTCP traffic: 192.168.2.12:56971 -> 78.46.117.76:587
          Source: global trafficTCP traffic: 192.168.2.12:56972 -> 64.136.44.40:587
          Source: global trafficTCP traffic: 192.168.2.12:56973 -> 185.138.56.213:587
          Source: global trafficTCP traffic: 192.168.2.12:56974 -> 104.21.112.1:587
          Source: global trafficTCP traffic: 192.168.2.12:56975 -> 195.32.69.33:587
          Source: global trafficTCP traffic: 192.168.2.12:56976 -> 74.125.200.26:587
          Source: global trafficTCP traffic: 192.168.2.12:56977 -> 151.101.1.193:587
          Source: global trafficTCP traffic: 192.168.2.12:56978 -> 104.131.176.42:587
          Source: global trafficTCP traffic: 192.168.2.12:56979 -> 51.81.206.109:587
          Source: global trafficTCP traffic: 192.168.2.12:56981 -> 84.2.43.67:587
          Source: global trafficTCP traffic: 192.168.2.12:56983 -> 146.75.118.114:587
          Source: global trafficTCP traffic: 192.168.2.12:56987 -> 185.53.178.51:587
          Source: global trafficTCP traffic: 192.168.2.12:56988 -> 67.205.17.103:587
          Source: global trafficTCP traffic: 192.168.2.12:56989 -> 187.85.164.163:587
          Source: global trafficTCP traffic: 192.168.2.12:56990 -> 52.96.125.66:587
          Source: global trafficTCP traffic: 192.168.2.12:56991 -> 170.10.150.242:587
          Source: global trafficTCP traffic: 192.168.2.12:56992 -> 62.149.128.151:587
          Source: global trafficTCP traffic: 192.168.2.12:56994 -> 65.20.63.172:587
          Source: global trafficTCP traffic: 192.168.2.12:56997 -> 142.222.6.191:587
          Source: global trafficTCP traffic: 192.168.2.12:56999 -> 194.153.145.104:587
          Source: global trafficTCP traffic: 192.168.2.12:57001 -> 66.234.112.67:587
          Source: global trafficTCP traffic: 192.168.2.12:57003 -> 160.251.102.56:587
          Source: global trafficTCP traffic: 192.168.2.12:57005 -> 194.145.247.36:587
          Source: global trafficTCP traffic: 192.168.2.12:57008 -> 120.50.131.112:587
          Source: global trafficTCP traffic: 192.168.2.12:57012 -> 195.130.131.33:587
          Source: global trafficTCP traffic: 192.168.2.12:57014 -> 162.210.196.167:587
          Source: global trafficTCP traffic: 192.168.2.12:57015 -> 8.210.167.147:587
          Source: global trafficTCP traffic: 192.168.2.12:57017 -> 81.236.63.162:587
          Source: global trafficTCP traffic: 192.168.2.12:57021 -> 62.149.128.202:587
          Source: global trafficTCP traffic: 192.168.2.12:57022 -> 103.173.250.2:587
          Source: global trafficTCP traffic: 192.168.2.12:57025 -> 185.185.170.37:587
          Source: global trafficTCP traffic: 192.168.2.12:57027 -> 217.160.233.72:587
          Source: global trafficTCP traffic: 192.168.2.12:57029 -> 200.144.248.41:587
          Source: global trafficTCP traffic: 192.168.2.12:57030 -> 69.46.28.43:587
          Source: global trafficTCP traffic: 192.168.2.12:57032 -> 194.106.216.130:25
          Source: global trafficTCP traffic: 192.168.2.12:57034 -> 194.25.134.110:587
          Source: global trafficTCP traffic: 192.168.2.12:57035 -> 23.227.38.70:587
          Source: global trafficTCP traffic: 192.168.2.12:57039 -> 130.69.92.10:587
          Source: global trafficTCP traffic: 192.168.2.12:57040 -> 51.159.138.107:587
          Source: global trafficTCP traffic: 192.168.2.12:57045 -> 222.15.69.195:587
          Source: global trafficTCP traffic: 192.168.2.12:57052 -> 51.254.35.55:25
          Source: global trafficTCP traffic: 192.168.2.12:57053 -> 194.152.32.10:587
          Source: global trafficTCP traffic: 192.168.2.12:57054 -> 185.138.56.194:587
          Source: global trafficTCP traffic: 192.168.2.12:57056 -> 77.75.78.196:587
          Source: global trafficTCP traffic: 192.168.2.12:57057 -> 202.172.28.128:587
          Source: global trafficTCP traffic: 192.168.2.12:57059 -> 216.29.225.176:587
          Source: global trafficTCP traffic: 192.168.2.12:57060 -> 63.135.176.5:587
          Source: global trafficTCP traffic: 192.168.2.12:57061 -> 217.160.0.40:587
          Source: global trafficTCP traffic: 192.168.2.12:57063 -> 104.21.16.1:587
          Source: global trafficTCP traffic: 192.168.2.12:57065 -> 86.43.151.3:587
          Source: global trafficTCP traffic: 192.168.2.12:57067 -> 87.98.160.167:587
          Source: global trafficTCP traffic: 192.168.2.12:57068 -> 3.33.130.190:587
          Source: global trafficTCP traffic: 192.168.2.12:57070 -> 64.29.145.194:587
          Source: global trafficTCP traffic: 192.168.2.12:57072 -> 199.235.124.212:587
          Source: global trafficTCP traffic: 192.168.2.12:57073 -> 117.53.114.15:587
          Source: global trafficTCP traffic: 192.168.2.12:57074 -> 96.99.227.0:587
          Source: global trafficTCP traffic: 192.168.2.12:57078 -> 194.63.249.216:587
          Source: global trafficTCP traffic: 192.168.2.12:57081 -> 69.195.119.116:587
          Source: global trafficTCP traffic: 192.168.2.12:57082 -> 52.92.20.188:587
          Source: global trafficTCP traffic: 192.168.2.12:57085 -> 138.246.224.218:587
          Source: global trafficTCP traffic: 192.168.2.12:57087 -> 103.228.17.25:587
          Source: global trafficTCP traffic: 192.168.2.12:53337 -> 180.37.199.210:587
          Source: global trafficTCP traffic: 192.168.2.12:53341 -> 149.202.135.9:587
          Source: global trafficTCP traffic: 192.168.2.12:53345 -> 62.101.76.218:587
          Source: global trafficTCP traffic: 192.168.2.12:53347 -> 13.33.187.22:587
          Source: global trafficTCP traffic: 192.168.2.12:53351 -> 180.37.199.181:587
          Source: global trafficTCP traffic: 192.168.2.12:53356 -> 17.253.142.4:587
          Source: global trafficTCP traffic: 192.168.2.12:53357 -> 142.250.153.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53359 -> 207.115.66.179:587
          Source: global trafficTCP traffic: 192.168.2.12:53366 -> 87.248.97.31:587
          Source: global trafficTCP traffic: 192.168.2.12:53367 -> 52.169.73.236:587
          Source: global trafficTCP traffic: 192.168.2.12:53369 -> 199.60.103.37:587
          Source: global trafficTCP traffic: 192.168.2.12:53371 -> 103.20.202.129:587
          Source: global trafficTCP traffic: 192.168.2.12:53372 -> 195.110.124.188:587
          Source: global trafficTCP traffic: 192.168.2.12:53377 -> 17.42.251.41:587
          Source: global trafficTCP traffic: 192.168.2.12:53379 -> 194.105.166.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53381 -> 194.185.246.171:587
          Source: global trafficTCP traffic: 192.168.2.12:53383 -> 133.237.129.136:587
          Source: global trafficTCP traffic: 192.168.2.12:53386 -> 77.75.77.222:587
          Source: global trafficTCP traffic: 192.168.2.12:53388 -> 62.129.239.251:587
          Source: global trafficTCP traffic: 192.168.2.12:53390 -> 62.149.128.201:587
          Source: global trafficTCP traffic: 192.168.2.12:53391 -> 148.163.143.241:587
          Source: global trafficTCP traffic: 192.168.2.12:53395 -> 81.169.145.97:587
          Source: global trafficTCP traffic: 192.168.2.12:53398 -> 64.91.253.60:587
          Source: global trafficTCP traffic: 192.168.2.12:53399 -> 193.122.179.25:587
          Source: global trafficTCP traffic: 192.168.2.12:53400 -> 77.221.39.216:587
          Source: global trafficTCP traffic: 192.168.2.12:53401 -> 183.111.138.176:587
          Source: global trafficTCP traffic: 192.168.2.12:53406 -> 211.249.221.105:587
          Source: global trafficTCP traffic: 192.168.2.12:53407 -> 34.102.212.0:587
          Source: global trafficTCP traffic: 192.168.2.12:53408 -> 142.250.186.51:587
          Source: global trafficTCP traffic: 192.168.2.12:53410 -> 199.224.64.207:587
          Source: global trafficTCP traffic: 192.168.2.12:53411 -> 85.236.153.201:587
          Source: global trafficTCP traffic: 192.168.2.12:53412 -> 183.181.85.107:587
          Source: global trafficTCP traffic: 192.168.2.12:53413 -> 139.134.5.153:587
          Source: global trafficTCP traffic: 192.168.2.12:53415 -> 213.209.1.147:587
          Source: global trafficTCP traffic: 192.168.2.12:53417 -> 5.35.226.210:587
          Source: global trafficTCP traffic: 192.168.2.12:53418 -> 195.130.132.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53424 -> 94.100.132.47:587
          Source: global trafficTCP traffic: 192.168.2.12:53427 -> 34.111.176.156:587
          Source: global trafficTCP traffic: 192.168.2.12:53429 -> 80.158.67.40:587
          Source: global trafficTCP traffic: 192.168.2.12:53434 -> 204.74.99.100:587
          Source: global trafficTCP traffic: 192.168.2.12:53436 -> 195.216.236.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53437 -> 66.29.137.15:587
          Source: global trafficTCP traffic: 192.168.2.12:53440 -> 66.159.240.41:587
          Source: global trafficTCP traffic: 192.168.2.12:53442 -> 112.78.125.109:587
          Source: global trafficTCP traffic: 192.168.2.12:53443 -> 80.168.44.10:25
          Source: global trafficTCP traffic: 192.168.2.12:53444 -> 213.209.1.146:587
          Source: global trafficTCP traffic: 192.168.2.12:53448 -> 45.60.134.168:587
          Source: global trafficTCP traffic: 192.168.2.12:53449 -> 216.98.197.3:587
          Source: global trafficTCP traffic: 192.168.2.12:53454 -> 212.7.147.128:587
          Source: global trafficTCP traffic: 192.168.2.12:53455 -> 168.0.132.203:587
          Source: global trafficTCP traffic: 192.168.2.12:53456 -> 59.157.128.15:587
          Source: global trafficTCP traffic: 192.168.2.12:53458 -> 52.18.216.171:587
          Source: global trafficTCP traffic: 192.168.2.12:53460 -> 85.13.149.138:587
          Source: global trafficTCP traffic: 192.168.2.12:53461 -> 205.220.160.150:587
          Source: global trafficTCP traffic: 192.168.2.12:53462 -> 175.135.252.193:587
          Source: global trafficTCP traffic: 192.168.2.12:53465 -> 80.48.169.1:587
          Source: global trafficTCP traffic: 192.168.2.12:53471 -> 62.104.23.16:587
          Source: global trafficTCP traffic: 192.168.2.12:53472 -> 185.151.30.160:587
          Source: global trafficTCP traffic: 192.168.2.12:53474 -> 187.6.211.40:587
          Source: global trafficTCP traffic: 192.168.2.12:53479 -> 72.167.67.229:587
          Source: global trafficTCP traffic: 192.168.2.12:53480 -> 54.236.189.61:587
          Source: global trafficTCP traffic: 192.168.2.12:53491 -> 38.55.13.75:587
          Source: global trafficTCP traffic: 192.168.2.12:53497 -> 80.91.55.62:587
          Source: global trafficTCP traffic: 192.168.2.12:53499 -> 142.250.185.147:587
          Source: global trafficTCP traffic: 192.168.2.12:53500 -> 142.250.185.83:587
          Source: global trafficTCP traffic: 192.168.2.12:53501 -> 208.91.197.39:587
          Source: global trafficTCP traffic: 192.168.2.12:53503 -> 119.205.215.249:587
          Source: global trafficTCP traffic: 192.168.2.12:53504 -> 52.60.87.163:587
          Source: global trafficTCP traffic: 192.168.2.12:53513 -> 52.101.40.1:25
          Source: global trafficTCP traffic: 192.168.2.12:53517 -> 206.213.211.176:587
          Source: global trafficTCP traffic: 192.168.2.12:53519 -> 13.107.213.43:587
          Source: global trafficTCP traffic: 192.168.2.12:53525 -> 198.12.234.215:587
          Source: global trafficTCP traffic: 192.168.2.12:53528 -> 93.17.128.165:587
          Source: global trafficTCP traffic: 192.168.2.12:53529 -> 208.91.199.225:587
          Source: global trafficTCP traffic: 192.168.2.12:53531 -> 213.205.32.10:587
          Source: global trafficTCP traffic: 192.168.2.12:53532 -> 213.168.87.11:587
          Source: global trafficTCP traffic: 192.168.2.12:53536 -> 217.160.0.179:587
          Source: global trafficTCP traffic: 192.168.2.12:53537 -> 210.151.38.80:587
          Source: global trafficTCP traffic: 192.168.2.12:53542 -> 159.134.198.135:587
          Source: global trafficTCP traffic: 192.168.2.12:53546 -> 212.11.228.67:587
          Source: global trafficTCP traffic: 192.168.2.12:53549 -> 43.245.43.88:587
          Source: global trafficTCP traffic: 192.168.2.12:53550 -> 37.97.231.106:587
          Source: global trafficTCP traffic: 192.168.2.12:53551 -> 152.74.16.8:587
          Source: global trafficTCP traffic: 192.168.2.12:53552 -> 76.223.84.192:587
          Source: global trafficTCP traffic: 192.168.2.12:53554 -> 164.70.78.188:587
          Source: global trafficTCP traffic: 192.168.2.12:53555 -> 99.83.190.102:587
          Source: global trafficTCP traffic: 192.168.2.12:53556 -> 209.71.208.6:587
          Source: global trafficTCP traffic: 192.168.2.12:53560 -> 90.216.128.5:587
          Source: global trafficTCP traffic: 192.168.2.12:53561 -> 35.213.174.122:587
          Source: global trafficTCP traffic: 192.168.2.12:53563 -> 195.130.132.9:587
          Source: global trafficTCP traffic: 192.168.2.12:53567 -> 193.81.82.81:587
          Source: global trafficTCP traffic: 192.168.2.12:53575 -> 202.177.34.74:587
          Source: global trafficTCP traffic: 192.168.2.12:53576 -> 104.18.9.233:587
          Source: global trafficTCP traffic: 192.168.2.12:53577 -> 15.204.43.61:587
          Source: global trafficTCP traffic: 192.168.2.12:53578 -> 108.138.26.35:587
          Source: global trafficTCP traffic: 192.168.2.12:53582 -> 64.59.136.142:587
          Source: global trafficTCP traffic: 192.168.2.12:53587 -> 114.179.184.189:587
          Source: global trafficTCP traffic: 192.168.2.12:53588 -> 52.218.92.180:587
          Source: global trafficTCP traffic: 192.168.2.12:53590 -> 117.18.152.49:587
          Source: global trafficTCP traffic: 192.168.2.12:53594 -> 195.238.22.30:587
          Source: global trafficTCP traffic: 192.168.2.12:53595 -> 92.205.149.199:587
          Source: global trafficTCP traffic: 192.168.2.12:53596 -> 217.70.36.87:587
          Source: global trafficTCP traffic: 192.168.2.12:53600 -> 167.206.237.230:587
          Source: global trafficTCP traffic: 192.168.2.12:53601 -> 41.76.108.130:587
          Source: global trafficTCP traffic: 192.168.2.12:53612 -> 142.250.150.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53613 -> 67.20.76.169:587
          Source: global trafficTCP traffic: 192.168.2.12:53614 -> 204.74.99.103:587
          Source: global trafficTCP traffic: 192.168.2.12:53615 -> 185.230.212.166:587
          Source: global trafficTCP traffic: 192.168.2.12:53618 -> 129.226.106.19:587
          Source: global trafficTCP traffic: 192.168.2.12:53623 -> 68.70.190.2:587
          Source: global trafficTCP traffic: 192.168.2.12:53626 -> 93.43.63.118:587
          Source: global trafficTCP traffic: 192.168.2.12:53630 -> 213.171.216.50:587
          Source: global trafficTCP traffic: 192.168.2.12:53631 -> 129.128.12.84:25
          Source: global trafficTCP traffic: 192.168.2.12:53633 -> 91.136.8.175:587
          Source: global trafficTCP traffic: 192.168.2.12:53634 -> 167.89.118.83:587
          Source: global trafficTCP traffic: 192.168.2.12:53635 -> 5.9.69.91:587
          Source: global trafficTCP traffic: 192.168.2.12:53637 -> 76.223.105.230:587
          Source: global trafficTCP traffic: 192.168.2.12:53638 -> 69.195.78.221:587
          Source: global trafficTCP traffic: 192.168.2.12:53640 -> 62.149.128.40:587
          Source: global trafficTCP traffic: 192.168.2.12:53642 -> 103.240.88.13:587
          Source: global trafficTCP traffic: 192.168.2.12:53643 -> 142.93.237.125:587
          Source: global trafficTCP traffic: 192.168.2.12:53649 -> 209.202.254.90:587
          Source: global trafficTCP traffic: 192.168.2.12:53659 -> 94.102.214.226:587
          Source: global trafficTCP traffic: 192.168.2.12:53663 -> 142.251.5.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53665 -> 104.18.4.230:587
          Source: global trafficTCP traffic: 192.168.2.12:53666 -> 43.250.142.67:587
          Source: global trafficTCP traffic: 192.168.2.12:53667 -> 162.159.133.90:587
          Source: global trafficTCP traffic: 192.168.2.12:53668 -> 87.238.28.12:587
          Source: global trafficTCP traffic: 192.168.2.12:53669 -> 35.168.64.20:587
          Source: global trafficTCP traffic: 192.168.2.12:53672 -> 67.231.149.213:587
          Source: global trafficTCP traffic: 192.168.2.12:53674 -> 59.157.130.138:587
          Source: global trafficTCP traffic: 192.168.2.12:53678 -> 62.142.5.237:587
          Source: global trafficTCP traffic: 192.168.2.12:53679 -> 200.34.200.231:587
          Source: global trafficTCP traffic: 192.168.2.12:53681 -> 23.88.34.196:587
          Source: global trafficTCP traffic: 192.168.2.12:53680 -> 52.101.10.1:25
          Source: global trafficTCP traffic: 192.168.2.12:53686 -> 175.135.252.195:587
          Source: global trafficTCP traffic: 192.168.2.12:53687 -> 64.90.62.162:587
          Source: global trafficTCP traffic: 192.168.2.12:53689 -> 62.149.188.200:587
          Source: global trafficTCP traffic: 192.168.2.12:53693 -> 89.38.148.142:587
          Source: global trafficTCP traffic: 192.168.2.12:53694 -> 64.190.63.222:587
          Source: global trafficTCP traffic: 192.168.2.12:53698 -> 180.37.199.33:587
          Source: global trafficTCP traffic: 192.168.2.12:53701 -> 13.248.158.7:587
          Source: global trafficTCP traffic: 192.168.2.12:53702 -> 117.50.20.113:587
          Source: global trafficTCP traffic: 192.168.2.12:53710 -> 188.165.36.237:587
          Source: global trafficTCP traffic: 192.168.2.12:53712 -> 210.131.2.36:587
          Source: global trafficTCP traffic: 192.168.2.12:53716 -> 123.57.253.119:587
          Source: global trafficTCP traffic: 192.168.2.12:53721 -> 198.185.159.144:587
          Source: global trafficTCP traffic: 192.168.2.12:53722 -> 52.101.190.0:25
          Source: global trafficTCP traffic: 192.168.2.12:53035 -> 64.98.38.4:587
          Source: global trafficTCP traffic: 192.168.2.12:53038 -> 208.28.90.228:587
          Source: global trafficTCP traffic: 192.168.2.12:53040 -> 41.193.157.227:587
          Source: global trafficTCP traffic: 192.168.2.12:53044 -> 142.250.181.238:587
          Source: global trafficTCP traffic: 192.168.2.12:53048 -> 85.13.128.49:587
          Source: global trafficTCP traffic: 192.168.2.12:53062 -> 89.238.73.103:587
          Source: global trafficTCP traffic: 192.168.2.12:53063 -> 195.121.65.26:587
          Source: global trafficTCP traffic: 192.168.2.12:53069 -> 101.50.87.231:587
          Source: global trafficTCP traffic: 192.168.2.12:53070 -> 217.160.72.6:587
          Source: global trafficTCP traffic: 192.168.2.12:59683 -> 216.150.240.141:587
          Source: global trafficTCP traffic: 192.168.2.12:59686 -> 62.146.106.50:587
          Source: global trafficTCP traffic: 192.168.2.12:59689 -> 185.76.64.29:587
          Source: global trafficTCP traffic: 192.168.2.12:59694 -> 3.125.131.179:587
          Source: global trafficTCP traffic: 192.168.2.12:59695 -> 151.164.129.2:587
          Source: global trafficTCP traffic: 192.168.2.12:59699 -> 206.188.192.242:587
          Source: global trafficTCP traffic: 192.168.2.12:59700 -> 216.71.129.20:587
          Source: global trafficTCP traffic: 192.168.2.12:59701 -> 91.235.52.77:587
          Source: global trafficTCP traffic: 192.168.2.12:59702 -> 167.172.23.243:587
          Source: global trafficTCP traffic: 192.168.2.12:59703 -> 217.182.102.160:587
          Source: global trafficTCP traffic: 192.168.2.12:59707 -> 62.103.146.102:587
          Source: global trafficTCP traffic: 192.168.2.12:59711 -> 38.210.213.88:587
          Source: global trafficTCP traffic: 192.168.2.12:59715 -> 198.164.4.15:587
          Source: global trafficTCP traffic: 192.168.2.12:59718 -> 85.93.219.12:587
          Source: global trafficTCP traffic: 192.168.2.12:59724 -> 205.220.162.39:25
          Source: global trafficTCP traffic: 192.168.2.12:59725 -> 82.113.237.91:587
          Source: global trafficTCP traffic: 192.168.2.12:59726 -> 180.37.199.26:587
          Source: global trafficTCP traffic: 192.168.2.12:59727 -> 190.225.183.42:587
          Source: global trafficTCP traffic: 192.168.2.12:59728 -> 15.197.134.120:587
          Source: global trafficTCP traffic: 192.168.2.12:59729 -> 193.239.248.167:587
          Source: global trafficTCP traffic: 192.168.2.12:59730 -> 140.227.93.96:587
          Source: global trafficTCP traffic: 192.168.2.12:59733 -> 54.84.180.161:587
          Source: global trafficTCP traffic: 192.168.2.12:59736 -> 219.90.66.200:587
          Source: global trafficTCP traffic: 192.168.2.12:59737 -> 52.18.59.124:587
          Source: global trafficTCP traffic: 192.168.2.12:59742 -> 194.72.80.196:587
          Source: global trafficTCP traffic: 192.168.2.12:59747 -> 45.82.189.130:587
          Source: global trafficTCP traffic: 192.168.2.12:59749 -> 193.201.172.118:25
          Source: global trafficTCP traffic: 192.168.2.12:59750 -> 103.226.222.162:587
          Source: global trafficTCP traffic: 192.168.2.12:59751 -> 60.36.166.235:587
          Source: global trafficTCP traffic: 192.168.2.12:59754 -> 185.46.229.190:587
          Source: global trafficTCP traffic: 192.168.2.12:59762 -> 23.37.55.159:587
          Source: global trafficTCP traffic: 192.168.2.12:59763 -> 15.197.225.128:587
          Source: global trafficTCP traffic: 192.168.2.12:59764 -> 66.96.132.61:587
          Source: global trafficTCP traffic: 192.168.2.12:59765 -> 52.193.247.45:587
          Source: global trafficTCP traffic: 192.168.2.12:59766 -> 195.8.66.22:587
          Source: global trafficTCP traffic: 192.168.2.12:59768 -> 103.6.199.109:587
          Source: global trafficTCP traffic: 192.168.2.12:54587 -> 82.144.228.4:587
          Source: global trafficTCP traffic: 192.168.2.12:54591 -> 80.67.172.22:587
          Source: global trafficTCP traffic: 192.168.2.12:54594 -> 52.101.89.0:587
          Source: global trafficTCP traffic: 192.168.2.12:54597 -> 202.27.184.102:587
          Source: global trafficTCP traffic: 192.168.2.12:54598 -> 13.238.239.16:587
          Source: global trafficTCP traffic: 192.168.2.12:54604 -> 212.33.194.58:587
          Source: global trafficTCP traffic: 192.168.2.12:54605 -> 185.230.63.107:587
          Source: global trafficTCP traffic: 192.168.2.12:54608 -> 155.231.208.2:587
          Source: global trafficTCP traffic: 192.168.2.12:54614 -> 194.25.225.136:587
          Source: global trafficTCP traffic: 192.168.2.12:54619 -> 60.36.166.219:587
          Source: global trafficTCP traffic: 192.168.2.12:54620 -> 175.135.253.3:587
          Source: global trafficTCP traffic: 192.168.2.12:54625 -> 162.255.118.7:587
          Source: global trafficTCP traffic: 192.168.2.12:54626 -> 210.166.222.44:587
          Source: global trafficTCP traffic: 192.168.2.12:54627 -> 216.40.42.189:587
          Source: global trafficTCP traffic: 192.168.2.12:54628 -> 69.195.88.144:587
          Source: global trafficTCP traffic: 192.168.2.12:54631 -> 128.100.132.104:587
          Source: global trafficTCP traffic: 192.168.2.12:54635 -> 37.61.245.7:587
          Source: global trafficTCP traffic: 192.168.2.12:54781 -> 18.205.78.10:587
          Source: global trafficTCP traffic: 192.168.2.12:54782 -> 52.64.198.206:587
          Source: global trafficTCP traffic: 192.168.2.12:54788 -> 188.40.120.147:587
          Source: global trafficTCP traffic: 192.168.2.12:54789 -> 164.124.141.203:587
          Source: global trafficTCP traffic: 192.168.2.12:54794 -> 104.102.59.175:587
          Source: global trafficTCP traffic: 192.168.2.12:54795 -> 34.165.90.62:25
          Source: global trafficTCP traffic: 192.168.2.12:54796 -> 46.30.215.149:587
          Source: global trafficTCP traffic: 192.168.2.12:54799 -> 129.213.180.114:587
          Source: global trafficTCP traffic: 192.168.2.12:54802 -> 80.168.44.12:25
          Source: global trafficTCP traffic: 192.168.2.12:54829 -> 134.151.36.50:587
          Source: global trafficTCP traffic: 192.168.2.12:54836 -> 62.149.128.166:587
          Source: global trafficTCP traffic: 192.168.2.12:54840 -> 195.249.151.222:587
          Source: global trafficTCP traffic: 192.168.2.12:54841 -> 200.155.160.201:25
          Source: global trafficTCP traffic: 192.168.2.12:54844 -> 209.17.116.160:587
          Source: global trafficTCP traffic: 192.168.2.12:54845 -> 149.97.246.199:587
          Source: global trafficTCP traffic: 192.168.2.12:50458 -> 141.94.139.121:587
          Source: global trafficTCP traffic: 192.168.2.12:50459 -> 212.135.1.103:587
          Source: global trafficTCP traffic: 192.168.2.12:50465 -> 180.37.199.143:587
          Source: global trafficTCP traffic: 192.168.2.12:50467 -> 147.67.34.30:587
          Source: global trafficTCP traffic: 192.168.2.12:50468 -> 185.187.81.214:587
          Source: global trafficTCP traffic: 192.168.2.12:50473 -> 200.40.52.164:587
          Source: global trafficTCP traffic: 192.168.2.12:50479 -> 110.4.46.117:587
          Source: global trafficTCP traffic: 192.168.2.12:50483 -> 209.222.82.255:587
          Source: global trafficTCP traffic: 192.168.2.12:50484 -> 86.109.167.69:587
          Source: global trafficTCP traffic: 192.168.2.12:50487 -> 52.101.68.15:587
          Source: global trafficTCP traffic: 192.168.2.12:50493 -> 65.87.230.8:587
          Source: global trafficTCP traffic: 192.168.2.12:50494 -> 208.91.196.152:587
          Source: global trafficTCP traffic: 192.168.2.12:50498 -> 202.224.54.66:587
          Source: global trafficTCP traffic: 192.168.2.12:50499 -> 79.170.40.147:587
          Source: global trafficTCP traffic: 192.168.2.12:50504 -> 208.91.197.27:587
          Source: global trafficTCP traffic: 192.168.2.12:62545 -> 203.249.96.35:587
          Source: global trafficTCP traffic: 192.168.2.12:62549 -> 186.192.83.12:587
          Source: global trafficTCP traffic: 192.168.2.12:62550 -> 52.20.84.62:587
          Source: global trafficTCP traffic: 192.168.2.12:62555 -> 108.184.162.115:587
          Source: global trafficTCP traffic: 192.168.2.12:62561 -> 94.100.136.8:587
          Source: global trafficTCP traffic: 192.168.2.12:62562 -> 64.18.172.220:587
          Source: global trafficTCP traffic: 192.168.2.12:62570 -> 217.198.120.97:587
          Source: global trafficTCP traffic: 192.168.2.12:62571 -> 75.126.100.12:587
          Source: global trafficTCP traffic: 192.168.2.12:62576 -> 183.90.250.34:587
          Source: global trafficTCP traffic: 192.168.2.12:62580 -> 103.224.182.251:587
          Source: global trafficTCP traffic: 192.168.2.12:62581 -> 104.22.65.144:587
          Source: global trafficTCP traffic: 192.168.2.12:62584 -> 203.249.96.80:587
          Source: global trafficTCP traffic: 192.168.2.12:62585 -> 119.252.155.19:587
          Source: global trafficTCP traffic: 192.168.2.12:62586 -> 194.254.242.35:587
          Source: global trafficTCP traffic: 192.168.2.12:62589 -> 52.218.108.60:587
          Source: global trafficTCP traffic: 192.168.2.12:62593 -> 150.214.204.23:587
          Source: global trafficTCP traffic: 192.168.2.12:62598 -> 27.120.211.44:587
          Source: global trafficTCP traffic: 192.168.2.12:62603 -> 3.33.133.19:587
          Source: global trafficTCP traffic: 192.168.2.12:54475 -> 54.38.201.205:587
          Source: global trafficTCP traffic: 192.168.2.12:54478 -> 216.69.141.86:587
          Source: global trafficTCP traffic: 192.168.2.12:54483 -> 104.244.126.243:587
          Source: global trafficTCP traffic: 192.168.2.12:54487 -> 194.106.222.254:587
          Source: global trafficTCP traffic: 192.168.2.12:54491 -> 165.212.120.200:587
          Source: global trafficTCP traffic: 192.168.2.12:55231 -> 209.235.144.9:587
          Source: global trafficTCP traffic: 192.168.2.12:55232 -> 148.163.146.23:587
          Source: global trafficTCP traffic: 192.168.2.12:55233 -> 47.246.146.57:587
          Source: global trafficTCP traffic: 192.168.2.12:55239 -> 193.85.2.14:587
          Source: global trafficTCP traffic: 192.168.2.12:55241 -> 216.71.123.21:587
          Source: global trafficTCP traffic: 192.168.2.12:49637 -> 185.132.182.106:25
          Source: global trafficTCP traffic: 192.168.2.12:49638 -> 24.226.22.25:587
          Source: global trafficTCP traffic: 192.168.2.12:49646 -> 131.104.93.93:587
          Source: global trafficTCP traffic: 192.168.2.12:49647 -> 103.20.212.67:587
          Source: global trafficTCP traffic: 192.168.2.12:49652 -> 144.160.235.144:587
          Source: global trafficTCP traffic: 192.168.2.12:49660 -> 35.209.87.79:587
          Source: global trafficTCP traffic: 192.168.2.12:49661 -> 178.208.39.154:587
          Source: global trafficTCP traffic: 192.168.2.12:49662 -> 165.212.65.113:587
          Source: global trafficTCP traffic: 192.168.2.12:49663 -> 45.60.74.41:587
          Source: global trafficTCP traffic: 192.168.2.12:49674 -> 88.150.153.47:587
          Source: global trafficTCP traffic: 192.168.2.12:49675 -> 142.132.181.81:587
          Source: global trafficTCP traffic: 192.168.2.12:51983 -> 195.154.179.117:587
          Source: global trafficTCP traffic: 192.168.2.12:51984 -> 143.167.1.214:587
          Source: global trafficTCP traffic: 192.168.2.12:51986 -> 35.161.243.212:587
          Source: global trafficTCP traffic: 192.168.2.12:51989 -> 103.126.92.253:587
          Source: global trafficTCP traffic: 192.168.2.12:51994 -> 52.218.62.148:587
          Source: global trafficTCP traffic: 192.168.2.12:49406 -> 209.87.239.66:587
          Source: global trafficTCP traffic: 192.168.2.12:49411 -> 38.111.141.40:587
          Source: global trafficTCP traffic: 192.168.2.12:49412 -> 81.0.66.51:587
          Source: global trafficTCP traffic: 192.168.2.12:49421 -> 66.159.233.158:587
          Source: global trafficTCP traffic: 192.168.2.12:49422 -> 180.37.194.38:587
          Source: global trafficTCP traffic: 192.168.2.12:49424 -> 185.53.179.171:25
          Source: global trafficTCP traffic: 192.168.2.12:49425 -> 13.236.218.94:25
          Source: global trafficTCP traffic: 192.168.2.12:49433 -> 143.210.133.109:587
          Source: global trafficTCP traffic: 192.168.2.12:49435 -> 185.97.174.196:587
          Source: global trafficTCP traffic: 192.168.2.12:49436 -> 212.85.97.129:587
          Source: global trafficTCP traffic: 192.168.2.12:51569 -> 167.206.148.154:587
          Source: global trafficTCP traffic: 192.168.2.12:51571 -> 43.246.152.100:587
          Source: global trafficTCP traffic: 192.168.2.12:51577 -> 3.142.71.33:587
          Source: global trafficTCP traffic: 192.168.2.12:51582 -> 142.132.166.12:587
          Source: global trafficTCP traffic: 192.168.2.12:51583 -> 216.17.3.48:587
          Source: global trafficTCP traffic: 192.168.2.12:51585 -> 62.149.128.157:587
          Source: global trafficTCP traffic: 192.168.2.12:51590 -> 160.251.107.179:587
          Source: global trafficTCP traffic: 192.168.2.12:51591 -> 87.106.35.26:587
          Source: global trafficTCP traffic: 192.168.2.12:64234 -> 89.161.255.10:587
          Source: global trafficTCP traffic: 192.168.2.12:64236 -> 200.58.110.204:587
          Source: global trafficTCP traffic: 192.168.2.12:64238 -> 194.78.153.52:587
          Source: global trafficTCP traffic: 192.168.2.12:64240 -> 106.153.227.9:587
          Source: global trafficTCP traffic: 192.168.2.12:64245 -> 170.246.147.62:587
          Source: global trafficTCP traffic: 192.168.2.12:64247 -> 23.7.244.207:587
          Source: global trafficTCP traffic: 192.168.2.12:64253 -> 140.227.104.171:587
          Source: global trafficTCP traffic: 192.168.2.12:64260 -> 203.134.71.82:587
          Source: global trafficTCP traffic: 192.168.2.12:64264 -> 80.237.138.5:587
          Source: global trafficTCP traffic: 192.168.2.12:64268 -> 17.57.155.28:587
          Source: global trafficTCP traffic: 192.168.2.12:64269 -> 94.20.74.2:587
          Source: global trafficTCP traffic: 192.168.2.12:64274 -> 209.67.129.100:587
          Source: global trafficTCP traffic: 192.168.2.12:64275 -> 52.98.18.50:587
          Source: global trafficTCP traffic: 192.168.2.12:64278 -> 134.147.42.237:587
          Source: global trafficTCP traffic: 192.168.2.12:64281 -> 91.212.26.172:587
          Source: global trafficTCP traffic: 192.168.2.12:64282 -> 31.15.10.30:587
          Source: global trafficTCP traffic: 192.168.2.12:64287 -> 137.74.0.55:587
          Source: global trafficTCP traffic: 192.168.2.12:64300 -> 104.18.235.36:587
          Source: global trafficTCP traffic: 192.168.2.12:64305 -> 217.147.144.66:587
          Source: global trafficTCP traffic: 192.168.2.12:64310 -> 67.69.168.9:587
          Source: global trafficTCP traffic: 192.168.2.12:64313 -> 85.233.160.22:587
          Source: global trafficTCP traffic: 192.168.2.12:64318 -> 3.5.67.244:587
          Source: global trafficTCP traffic: 192.168.2.12:49978 -> 45.239.111.63:587
          Source: global trafficTCP traffic: 192.168.2.12:49982 -> 193.74.71.25:587
          Source: global trafficTCP traffic: 192.168.2.12:49983 -> 103.224.182.240:587
          Source: global trafficTCP traffic: 192.168.2.12:49985 -> 195.10.232.21:587
          Source: global trafficTCP traffic: 192.168.2.12:49991 -> 209.240.204.200:587
          Source: global trafficTCP traffic: 192.168.2.12:49998 -> 128.176.6.221:587
          Source: global trafficTCP traffic: 192.168.2.12:50002 -> 207.115.69.27:587
          Source: global trafficTCP traffic: 192.168.2.12:50003 -> 202.212.219.44:587
          Source: global trafficTCP traffic: 192.168.2.12:50012 -> 80.158.66.24:587
          Source: global trafficTCP traffic: 192.168.2.12:50015 -> 54.147.36.126:587
          Source: global trafficTCP traffic: 192.168.2.12:50028 -> 176.235.24.54:587
          Source: global trafficTCP traffic: 192.168.2.12:63964 -> 139.95.6.107:587
          Source: global trafficTCP traffic: 192.168.2.12:63974 -> 222.73.173.98:25
          Source: global trafficTCP traffic: 192.168.2.12:63975 -> 106.187.245.236:587
          Source: global trafficTCP traffic: 192.168.2.12:63978 -> 202.138.49.32:587
          Source: global trafficTCP traffic: 192.168.2.12:63981 -> 217.76.146.62:587
          Source: global trafficTCP traffic: 192.168.2.12:63983 -> 140.238.130.31:587
          Source: global trafficTCP traffic: 192.168.2.12:63989 -> 46.51.204.184:587
          Source: global trafficTCP traffic: 192.168.2.12:63990 -> 92.204.41.31:587
          Source: global trafficTCP traffic: 192.168.2.12:63992 -> 211.29.132.105:587
          Source: global trafficTCP traffic: 192.168.2.12:63997 -> 112.78.112.152:587
          Source: global trafficTCP traffic: 192.168.2.12:53235 -> 199.224.64.206:587
          Source: global trafficTCP traffic: 192.168.2.12:56891 -> 195.110.124.133:587
          Source: global trafficTCP traffic: 192.168.2.12:56894 -> 104.18.3.81:587
          Source: global trafficTCP traffic: 192.168.2.12:56895 -> 209.216.88.85:587
          Source: global trafficTCP traffic: 192.168.2.12:56896 -> 200.33.202.70:587
          Source: global trafficTCP traffic: 192.168.2.12:56900 -> 74.208.5.21:587
          Source: global trafficTCP traffic: 192.168.2.12:56903 -> 20.43.132.130:587
          Source: global trafficTCP traffic: 192.168.2.12:56904 -> 83.143.217.131:587
          Source: global trafficTCP traffic: 192.168.2.12:56912 -> 98.159.192.194:587
          Source: global trafficTCP traffic: 192.168.2.12:56916 -> 170.33.13.246:587
          Source: global trafficTCP traffic: 192.168.2.12:56917 -> 217.160.0.155:587
          Source: global trafficTCP traffic: 192.168.2.12:56937 -> 195.171.90.198:587
          Source: global trafficTCP traffic: 192.168.2.12:56965 -> 148.163.150.43:25
          Source: global trafficTCP traffic: 192.168.2.12:56981 -> 46.17.173.222:587
          Source: global trafficTCP traffic: 192.168.2.12:56985 -> 80.241.60.212:587
          Source: global trafficTCP traffic: 192.168.2.12:56990 -> 13.91.95.74:587
          Source: global trafficTCP traffic: 192.168.2.12:56991 -> 147.182.180.139:587
          Source: global trafficTCP traffic: 192.168.2.12:56996 -> 3.94.41.167:587
          Source: global trafficTCP traffic: 192.168.2.12:57010 -> 207.194.132.144:587
          Source: global trafficTCP traffic: 192.168.2.12:57052 -> 5.153.90.150:587
          Source: global trafficTCP traffic: 192.168.2.12:57057 -> 45.60.75.51:587
          Source: global trafficTCP traffic: 192.168.2.12:57070 -> 51.132.65.86:587
          Source: global trafficTCP traffic: 192.168.2.12:57072 -> 195.254.252.211:587
          Source: global trafficTCP traffic: 192.168.2.12:57073 -> 78.27.225.105:587
          Source: global trafficTCP traffic: 192.168.2.12:57075 -> 80.150.6.143:587
          Source: global trafficTCP traffic: 192.168.2.12:57077 -> 98.83.184.133:587
          Source: global trafficTCP traffic: 192.168.2.12:57110 -> 2.23.209.28:587
          Source: global trafficTCP traffic: 192.168.2.12:57111 -> 212.10.10.65:587
          Source: global trafficHTTP traffic detected: GET http://v4.ident.me?Z78706324841Q1 HTTP/1.1Host: v4.ident.meCookie: Z78706324841Q1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https://best-proxies.ru/faq/#from)Referer: https://google.com/Content-Type: application/x-www-form-urlencodedContent-Length: 9Connection: closeData Raw: 70 6f 73 74 3d 74 72 75 65 0d 0a 0d 0a Data Ascii: post=true
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.60
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.60
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.60
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.60
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.60
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.60
          Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.60
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficHTTP traffic detected: GET http://v4.ident.me?Z78706324841Q1 HTTP/1.1Host: v4.ident.meCookie: Z78706324841Q1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https://best-proxies.ru/faq/#from)Referer: https://google.com/Content-Type: application/x-www-form-urlencodedContent-Length: 9Connection: closeData Raw: 70 6f 73 74 3d 74 72 75 65 0d 0a 0d 0a Data Ascii: post=true
          Source: global trafficDNS traffic detected: DNS query: wodresomdaymomentum.org
          Source: global trafficDNS traffic detected: DNS query: smtp.virgilio.it
          Source: global trafficDNS traffic detected: DNS query: i.softbank.jp
          Source: global trafficDNS traffic detected: DNS query: linshiyouxiang.net
          Source: global trafficDNS traffic detected: DNS query: smtp.cogeco.ca
          Source: global trafficDNS traffic detected: DNS query: smtp.shaw.ca
          Source: global trafficDNS traffic detected: DNS query: smtp.theanswer.co.nz
          Source: global trafficDNS traffic detected: DNS query: out.supereva.it
          Source: global trafficDNS traffic detected: DNS query: epost.de
          Source: global trafficDNS traffic detected: DNS query: smtp.ezweb.ne.jp
          Source: global trafficDNS traffic detected: DNS query: earthlink.net
          Source: global trafficDNS traffic detected: DNS query: smtp.luukku.com
          Source: global trafficDNS traffic detected: DNS query: smtp.netzero.com
          Source: global trafficDNS traffic detected: DNS query: mail.p16.f177.n450.z2.fidonet.org
          Source: global trafficDNS traffic detected: DNS query: walmart.com
          Source: global trafficDNS traffic detected: DNS query: smtp.salmakov.com
          Source: global trafficDNS traffic detected: DNS query: aspmx3.googlemail.com
          Source: global trafficDNS traffic detected: DNS query: howdenbuffalo.com
          Source: global trafficDNS traffic detected: DNS query: out.click21.com.br
          Source: global trafficDNS traffic detected: DNS query: secure.salud.madrid.org
          Source: global trafficDNS traffic detected: DNS query: securesmtp.beatmedia.ca
          Source: global trafficDNS traffic detected: DNS query: mail.groupe-casino.fr
          Source: global trafficDNS traffic detected: DNS query: alt2.aspmx.l.google.com
          Source: global trafficDNS traffic detected: DNS query: out.alicedsl.de
          Source: global trafficDNS traffic detected: DNS query: secure.raesz.com
          Source: global trafficDNS traffic detected: DNS query: out.key4.it
          Source: global trafficDNS traffic detected: DNS query: mail.howardleight.com
          Source: global trafficDNS traffic detected: DNS query: out.sick.hu
          Source: global trafficDNS traffic detected: DNS query: smtp.iinet.net.au
          Source: global trafficDNS traffic detected: DNS query: vesta.dti.ne.jp
          Source: global trafficDNS traffic detected: DNS query: secure.dupolnext.it
          Source: global trafficDNS traffic detected: DNS query: yorku.ca
          Source: global trafficDNS traffic detected: DNS query: mx1.mailna.me
          Source: global trafficDNS traffic detected: DNS query: estrategiasch.com.mx
          Source: global trafficDNS traffic detected: DNS query: smtp.lo.fr
          Source: global trafficDNS traffic detected: DNS query: mail.yguzqzxn.com
          Source: global trafficDNS traffic detected: DNS query: out.rheinfussball.de
          Source: global trafficDNS traffic detected: DNS query: testwww.commandersofevony.com
          Source: global trafficDNS traffic detected: DNS query: docomo.ne.jp
          Source: global trafficDNS traffic detected: DNS query: gym-lachendorf.de
          Source: global trafficDNS traffic detected: DNS query: amber.plala.or.jp
          Source: global trafficDNS traffic detected: DNS query: out.web.jp
          Source: global trafficDNS traffic detected: DNS query: smtp.grupotel.com.br
          Source: global trafficDNS traffic detected: DNS query: smtp.libero.es
          Source: global trafficDNS traffic detected: DNS query: gwi.net
          Source: global trafficDNS traffic detected: DNS query: mail.equinoxcomm.co.uk
          Source: global trafficDNS traffic detected: DNS query: smtp.that.com
          Source: global trafficDNS traffic detected: DNS query: securesmtp.ig.com
          Source: global trafficDNS traffic detected: DNS query: secure.ics.fi
          Source: global trafficDNS traffic detected: DNS query: ALT3.ASPMX.L.GOOGLE.com
          Source: global trafficDNS traffic detected: DNS query: smtp.seznam.cz
          Source: global trafficDNS traffic detected: DNS query: planetweb.co.uk
          Source: global trafficDNS traffic detected: DNS query: mynet.com
          Source: global trafficDNS traffic detected: DNS query: out.carm.es
          Source: global trafficDNS traffic detected: DNS query: smtp.het.con
          Source: global trafficDNS traffic detected: DNS query: out.get2net.dk
          Source: global trafficDNS traffic detected: DNS query: securesmtp.escal.fr
          Source: global trafficDNS traffic detected: DNS query: smtp.autotrasportimm.it
          Source: global trafficDNS traffic detected: DNS query: gfarchitects.co.uk
          Source: global trafficDNS traffic detected: DNS query: mail.nexgo.de
          Source: global trafficDNS traffic detected: DNS query: secure.osrecruiting.com
          Source: global trafficDNS traffic detected: DNS query: out.pinkinbox.org
          Source: global trafficDNS traffic detected: DNS query: securesmtp.fechtverband.onmicrosoft.com
          Source: global trafficDNS traffic detected: DNS query: princeton.navy.mil
          Source: global trafficDNS traffic detected: DNS query: smtp.mun.ca
          Source: global trafficDNS traffic detected: DNS query: us.army.mil
          Source: global trafficDNS traffic detected: DNS query: secure.hometelchandigarh.com
          Source: global trafficDNS traffic detected: DNS query: secure.griffintravelandcruise.com
          Source: global trafficDNS traffic detected: DNS query: mail.belgametal.com.br
          Source: global trafficDNS traffic detected: DNS query: out.drewnex.eu
          Source: global trafficDNS traffic detected: DNS query: t-online.de
          Source: global trafficDNS traffic detected: DNS query: zing.vn
          Source: global trafficDNS traffic detected: DNS query: mx.mail-data.net
          Source: global trafficDNS traffic detected: DNS query: secure.pah.org.uk
          Source: global trafficDNS traffic detected: DNS query: sympatico.ca
          Source: global trafficDNS traffic detected: DNS query: rifoodbank-org.mail.protection.outlook.com
          Source: global trafficDNS traffic detected: DNS query: c.vodafone.ne.jp
          Source: global trafficDNS traffic detected: DNS query: cree-8.co.uk
          Source: global trafficDNS traffic detected: DNS query: mail.gruppocofit.it
          Source: global trafficDNS traffic detected: DNS query: in.com
          Source: global trafficDNS traffic detected: DNS query: mail.alumnos.uacj.mx
          Source: global trafficDNS traffic detected: DNS query: mx00.ionos.fr
          Source: global trafficDNS traffic detected: DNS query: secure.lpsnet.nl
          Source: global trafficDNS traffic detected: DNS query: rogers.com
          Source: global trafficDNS traffic detected: DNS query: trisportgolf.com
          Source: global trafficDNS traffic detected: DNS query: out.hsuas.com.au
          Source: global trafficDNS traffic detected: DNS query: out.nezid.com
          Source: global trafficDNS traffic detected: DNS query: smtp.mv-hallstadt.de
          Source: global trafficDNS traffic detected: DNS query: smtp.bbox.fr
          Source: global trafficDNS traffic detected: DNS query: mx.wal-martconnect.com
          Source: global trafficDNS traffic detected: DNS query: smtp.me.co
          Source: global trafficDNS traffic detected: DNS query: relay-avs.poste.it
          Source: global trafficDNS traffic detected: DNS query: out.the-entourage.com.au
          Source: global trafficDNS traffic detected: DNS query: out.merchavia.org.il
          Source: global trafficDNS traffic detected: DNS query: secure.its.jnj.com
          Source: global trafficDNS traffic detected: DNS query: out.111.comyr.com
          Source: global trafficDNS traffic detected: DNS query: mail.sms.at
          Source: global trafficDNS traffic detected: DNS query: mail.lorientuk.com
          Source: global trafficDNS traffic detected: DNS query: smtp.blackfoot.net
          Source: global trafficDNS traffic detected: DNS query: smtp.intergga.ch
          Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708

          Spam, unwanted Advertisements and Ransom Demands

          barindex
          Send many emails (e-Mail Spam)
          Source: SMTPNetwork traffic detected: Mail traffic on many different IPs 406

          System Summary

          barindex
          PE file contains section with special chars
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name:
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name: .idata
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name:
          Source: lfaslh.exe.0.drStatic PE information: section name:
          Source: lfaslh.exe.0.drStatic PE information: section name: .idata
          Source: lfaslh.exe.0.drStatic PE information: section name:
          Source: C:\ProgramData\hkij\lfaslh.exeProcess Stats: CPU usage > 49%
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeFile created: C:\Windows\Tasks\Test Task17.jobJump to behavior
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: Section: vbjkkwcb ZLIB complexity 0.9943735290271967
          Source: lfaslh.exe.0.drStatic PE information: Section: vbjkkwcb ZLIB complexity 0.9943735290271967
          Source: classification engineClassification label: mal100.spre.troj.evad.mine.winEXE@2/3@4511/100
          Source: C:\ProgramData\hkij\lfaslh.exeMutant created: \Sessions\1\BaseNamedObjects\Test Task17
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeVirustotal: Detection: 45%
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeReversingLabs: Detection: 57%
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
          Source: lfaslh.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe"
          Source: unknownProcess created: C:\ProgramData\hkij\lfaslh.exe C:\ProgramData\hkij\lfaslh.exe
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: mstask.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSection loaded: mpr.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: winmm.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: mstask.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: wsock32.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32Jump to behavior
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic file information: File size 1734656 > 1048576
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: Raw size of vbjkkwcb is bigger than: 0x100000 < 0x1a2400

          Data Obfuscation

          barindex
          Detected unpacking (changes PE section rights)
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeUnpacked PE file: 0.2.SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vbjkkwcb:EW;nvnpyqem:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vbjkkwcb:EW;nvnpyqem:EW;.taggant:EW;
          Source: C:\ProgramData\hkij\lfaslh.exeUnpacked PE file: 2.2.lfaslh.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vbjkkwcb:EW;nvnpyqem:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vbjkkwcb:EW;nvnpyqem:EW;.taggant:EW;
          Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: real checksum: 0x1b3b5a should be: 0x1b25bc
          Source: lfaslh.exe.0.drStatic PE information: real checksum: 0x1b3b5a should be: 0x1b25bc
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name:
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name: .idata
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name:
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name: vbjkkwcb
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name: nvnpyqem
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name: .taggant
          Source: lfaslh.exe.0.drStatic PE information: section name:
          Source: lfaslh.exe.0.drStatic PE information: section name: .idata
          Source: lfaslh.exe.0.drStatic PE information: section name:
          Source: lfaslh.exe.0.drStatic PE information: section name: vbjkkwcb
          Source: lfaslh.exe.0.drStatic PE information: section name: nvnpyqem
          Source: lfaslh.exe.0.drStatic PE information: section name: .taggant
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name: entropy: 7.7546108822478
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeStatic PE information: section name: vbjkkwcb entropy: 7.951847273675121
          Source: lfaslh.exe.0.drStatic PE information: section name: entropy: 7.7546108822478
          Source: lfaslh.exe.0.drStatic PE information: section name: vbjkkwcb entropy: 7.951847273675121
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeFile created: C:\ProgramData\hkij\lfaslh.exeJump to dropped file
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeFile created: C:\ProgramData\hkij\lfaslh.exeJump to dropped file

          Boot Survival

          barindex
          Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeWindow searched: window name: FilemonClassJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeWindow searched: window name: RegmonClassJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeWindow searched: window name: FilemonClassJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: FilemonClassJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: RegmonClassJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: FilemonClassJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: RegmonclassJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: FilemonclassJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow searched: window name: RegmonclassJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeFile created: C:\Windows\Tasks\Test Task17.jobJump to behavior

          Malware Analysis System Evasion

          barindex
          Tries to detect sandboxes / dynamic malware analysis system (registry check)
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 40BB5B second address: 40BB61 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 568F0C second address: 568F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57D547 second address: 57D54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57D54C second address: 57D551 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57D6CF second address: 57D6D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57D6D5 second address: 57D6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57D6D9 second address: 57D718 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB1F11658D4h 0x0000000c jmp 00007FB1F11658C8h 0x00000011 je 00007FB1F11658B6h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB1F11658C1h 0x00000020 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57D88B second address: 57D890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57D890 second address: 57D896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57DA1B second address: 57DA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57DA21 second address: 57DA32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57DA32 second address: 57DA37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57DA37 second address: 57DA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57DD30 second address: 57DD34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57DD34 second address: 57DD5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007FB1F11658B6h 0x00000011 jnc 00007FB1F11658B6h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB1F11658BEh 0x00000020 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 57DD5D second address: 57DD73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Fh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580B9A second address: 580BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c jns 00007FB1F11658B6h 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580BBE second address: 580BC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580BC2 second address: 580BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580C4D second address: 580C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580C62 second address: 580C93 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB1F11658BCh 0x00000008 jng 00007FB1F11658B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov ecx, 453A84F4h 0x00000018 push 00000000h 0x0000001a sub dword ptr [ebp+122D1C0Ch], edi 0x00000020 call 00007FB1F11658B9h 0x00000025 pushad 0x00000026 push ebx 0x00000027 pushad 0x00000028 popad 0x00000029 pop ebx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580C93 second address: 580CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FB1F10F4C3Bh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push esi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop esi 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580CBF second address: 580CC5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580CC5 second address: 580CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580DA2 second address: 580DAC instructions: 0x00000000 rdtsc 0x00000002 js 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580DAC second address: 580DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FB1F10F4C36h 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580DB6 second address: 580DD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FB1F11658B8h 0x00000014 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580DD6 second address: 580DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580EC2 second address: 580EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580EC8 second address: 580EEB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB1F10F4C48h 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580EEB second address: 580F05 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007FB1F11658B6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 js 00007FB1F11658B6h 0x00000019 pop eax 0x0000001a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580F05 second address: 580F0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB1F10F4C36h 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580F0F second address: 580F1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580F1F second address: 580F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580F23 second address: 580F2D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 580F2D second address: 580F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 581002 second address: 581032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007FB1F11658C4h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D1C0Ch], edx 0x00000017 push 730CBBBAh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 581032 second address: 581039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A22AF second address: 5A22B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB1F11658B6h 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A22B9 second address: 5A22CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A01A7 second address: 5A01AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A01AB second address: 5A01B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB1F10F4C36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A01B5 second address: 5A01C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FB1F11658B8h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A01C3 second address: 5A01D3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB1F10F4C42h 0x00000008 jbe 00007FB1F10F4C36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A01D3 second address: 5A01DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jng 00007FB1F11658B6h 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A0371 second address: 5A0375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A0375 second address: 5A0397 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C8h 0x00000007 jns 00007FB1F11658B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A07A7 second address: 5A07B3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A07B3 second address: 5A07B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A07B9 second address: 5A07DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB1F10F4C44h 0x0000000d jc 00007FB1F10F4C36h 0x00000013 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A07DB second address: 5A07E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A0935 second address: 5A093A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A093A second address: 5A0940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A0940 second address: 5A0967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB1F10F4C45h 0x0000000d jmp 00007FB1F10F4C3Ah 0x00000012 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A0ABC second address: 5A0AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A137F second address: 5A139D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1F10F4C49h 0x00000009 pop ecx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A139D second address: 5A13A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB1F11658B6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5942CD second address: 5942E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB1F10F4C44h 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5942E7 second address: 5942EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 56F8F4 second address: 56F8FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 56F8FA second address: 56F915 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 56F915 second address: 56F934 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB1F10F4C36h 0x00000008 jmp 00007FB1F10F4C45h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 56F934 second address: 56F951 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB1F11658C4h 0x0000000a pop ebx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A1D10 second address: 5A1D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A1E65 second address: 5A1E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A215B second address: 5A215F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A668F second address: 5A6698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A6698 second address: 5A669C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5A6B54 second address: 5A6B66 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FB1F11658B6h 0x00000012 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5ACEF8 second address: 5ACF00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AD1C4 second address: 5AD1DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658C3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AD1DD second address: 5AD1E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AD1E1 second address: 5AD202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FB1F11658BBh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AD934 second address: 5AD93A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AE9CE second address: 5AE9D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AE9D2 second address: 5AE9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AE9DC second address: 5AEA23 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jmp 00007FB1F11658C3h 0x0000000f pop edx 0x00000010 jmp 00007FB1F11658C7h 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b push ecx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 ja 00007FB1F11658B6h 0x00000027 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AEA23 second address: 5AEA70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jno 00007FB1F10F4C38h 0x00000013 jmp 00007FB1F10F4C3Bh 0x00000018 popad 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e push edi 0x0000001f jmp 00007FB1F10F4C3Eh 0x00000024 pop edi 0x00000025 pushad 0x00000026 jng 00007FB1F10F4C36h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AF65C second address: 5AF66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 jng 00007FB1F11658D4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AF746 second address: 5AF74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AF86E second address: 5AF888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB1F11658C1h 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AF9F0 second address: 5AFA05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AFA05 second address: 5AFA0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5AFAEF second address: 5AFAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B0BEC second address: 5B0BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B0BF9 second address: 5B0BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B0A27 second address: 5B0A55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB1F11658BFh 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B2928 second address: 5B292D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B1580 second address: 5B1585 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B2707 second address: 5B2715 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB1F10F4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B292D second address: 5B2933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B2933 second address: 5B2937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B2937 second address: 5B2949 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B2949 second address: 5B294E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B356F second address: 5B35F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jmp 00007FB1F11658BAh 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FB1F11658B8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D3A37h] 0x00000036 push 00000000h 0x00000038 jmp 00007FB1F11658BDh 0x0000003d push 00000000h 0x0000003f add edi, dword ptr [ebp+122D38ABh] 0x00000045 xchg eax, ebx 0x00000046 jmp 00007FB1F11658C8h 0x0000004b push eax 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FB1F11658BBh 0x00000054 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B35F5 second address: 5B3603 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB1F10F4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B97FD second address: 5B9844 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB1F11658BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edi 0x0000000d jmp 00007FB1F11658BEh 0x00000012 pop edi 0x00000013 pop eax 0x00000014 nop 0x00000015 jmp 00007FB1F11658C1h 0x0000001a push 00000000h 0x0000001c mov edi, esi 0x0000001e push 00000000h 0x00000020 xor dword ptr [ebp+122D1DCCh], edx 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BB734 second address: 5BB739 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BB739 second address: 5BB75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB1F11658C0h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB1F11658BBh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BBCC7 second address: 5BBCCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BBCCB second address: 5BBCE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BDD82 second address: 5BDD86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BDE5D second address: 5BDE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C0DF4 second address: 5C0DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BBEAC second address: 5BBEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C1EA7 second address: 5C1EAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C1EAE second address: 5C1EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FB1F11658B6h 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BEF94 second address: 5BEF98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BEF98 second address: 5BEFFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FB1F11658B8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 adc di, 7F92h 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov edi, dword ptr [ebp+122D3793h] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d or di, 0EBCh 0x00000042 mov eax, dword ptr [ebp+122D169Dh] 0x00000048 mov edi, esi 0x0000004a push FFFFFFFFh 0x0000004c movsx edi, si 0x0000004f push eax 0x00000050 push ecx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FB1F11658BDh 0x00000058 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5BEFFA second address: 5BEFFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C2EC3 second address: 5C2F12 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FB1F11658B8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov dword ptr [ebp+12461E38h], ebx 0x0000002b push 00000000h 0x0000002d mov di, 2913h 0x00000031 push 00000000h 0x00000033 and edi, 6AA601BEh 0x00000039 pushad 0x0000003a or edi, 246341A9h 0x00000040 popad 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 pop ebx 0x00000048 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C2F12 second address: 5C2F18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C2F18 second address: 5C2F1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C3E6D second address: 5C3E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 sub dword ptr [ebp+122D280Fh], eax 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+122D24E4h], edx 0x00000015 push 00000000h 0x00000017 movsx edi, bx 0x0000001a clc 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB1F10F4C43h 0x00000023 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C3E9E second address: 5C3EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C7042 second address: 5C7046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C3FCA second address: 5C3FD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C3FD0 second address: 5C3FD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C3FD6 second address: 5C3FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C3FDA second address: 5C3FDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C20BC second address: 5C20C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C6118 second address: 5C611C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C7E07 second address: 5C7E11 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C8CFD second address: 5C8D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C8D01 second address: 5C8D23 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FB1F11658B8h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FB1F11658BCh 0x0000001a jp 00007FB1F11658B6h 0x00000020 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5C8EBE second address: 5C8EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5CC0C1 second address: 5CC0C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 572E19 second address: 572E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3CB5 second address: 5D3CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3CB9 second address: 5D3CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3CC3 second address: 5D3CCD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3CCD second address: 5D3CD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3CD4 second address: 5D3CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3CE1 second address: 5D3D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 jmp 00007FB1F10F4C48h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3D04 second address: 5D3D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3E3E second address: 5D3E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3E45 second address: 5D3E5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C0h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3E5A second address: 5D3E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3E66 second address: 5D3E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D3E6C second address: 5D3EA9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FB1F10F4C4Ah 0x0000000c jnl 00007FB1F10F4C38h 0x00000012 pushad 0x00000013 jmp 00007FB1F10F4C3Ch 0x00000018 jo 00007FB1F10F4C36h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5D97BD second address: 5D97C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5DA42A second address: 40BB5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3628891Dh 0x00000010 jmp 00007FB1F10F4C45h 0x00000015 push dword ptr [ebp+122D0745h] 0x0000001b jmp 00007FB1F10F4C3Ch 0x00000020 call dword ptr [ebp+122D1DAFh] 0x00000026 pushad 0x00000027 mov dword ptr [ebp+122D2663h], edx 0x0000002d xor eax, eax 0x0000002f jmp 00007FB1F10F4C48h 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 sub dword ptr [ebp+122D19CCh], ebx 0x0000003e mov dword ptr [ebp+122D3A13h], eax 0x00000044 mov dword ptr [ebp+122D252Dh], edx 0x0000004a mov esi, 0000003Ch 0x0000004f pushad 0x00000050 mov dx, 7915h 0x00000054 pushad 0x00000055 mov esi, 396CE124h 0x0000005a mov dword ptr [ebp+122D1B9Eh], ecx 0x00000060 popad 0x00000061 popad 0x00000062 add esi, dword ptr [esp+24h] 0x00000066 je 00007FB1F10F4C37h 0x0000006c cld 0x0000006d lodsw 0x0000006f jmp 00007FB1F10F4C47h 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 mov dword ptr [ebp+122D1ADEh], ecx 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 pushad 0x00000083 mov cl, dh 0x00000085 call 00007FB1F10F4C40h 0x0000008a mov dword ptr [ebp+122D1B9Eh], ebx 0x00000090 pop eax 0x00000091 popad 0x00000092 jmp 00007FB1F10F4C48h 0x00000097 push eax 0x00000098 push eax 0x00000099 push edx 0x0000009a push eax 0x0000009b push edx 0x0000009c push edx 0x0000009d pop edx 0x0000009e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E0520 second address: 5E052A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E052A second address: 5E0559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007FB1F10F4C36h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnl 00007FB1F10F4C4Ah 0x00000013 je 00007FB1F10F4C53h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5DF85B second address: 5DF872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1F11658C3h 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5DF872 second address: 5DF882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5DFBF6 second address: 5DFC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB1F11658B6h 0x0000000a pop ecx 0x0000000b jmp 00007FB1F11658BFh 0x00000010 jnl 00007FB1F11658C9h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pop edx 0x0000001c pop eax 0x0000001d jng 00007FB1F11658B8h 0x00000023 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5DFC38 second address: 5DFC3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5DFF34 second address: 5DFF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E0206 second address: 5E021C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB1F10F4C36h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007FB1F10F4C36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E021C second address: 5E0221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E038D second address: 5E03A4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB1F10F4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E03A4 second address: 5E03A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E03A8 second address: 5E03C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C49h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E03C7 second address: 5E03CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E03CC second address: 5E03D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E631B second address: 5E6323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E6323 second address: 5E6327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E6327 second address: 5E634D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FB1F11658BCh 0x0000000c jg 00007FB1F11658B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB1F11658C2h 0x00000019 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E4E37 second address: 5E4E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E4FD2 second address: 5E4FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E4FD7 second address: 5E4FDC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E4FDC second address: 5E4FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E5846 second address: 5E584A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E584A second address: 5E5850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E5850 second address: 5E585E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FB1F10F4C42h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E59EE second address: 5E59FE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB1F11658B6h 0x00000008 jl 00007FB1F11658B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E59FE second address: 5E5A14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F10F4C40h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E5A14 second address: 5E5A67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C8h 0x00000007 jbe 00007FB1F11658B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB1F11658C3h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jnl 00007FB1F11658BAh 0x0000001e jno 00007FB1F11658C0h 0x00000024 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E5BDE second address: 5E5BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB1F10F4C44h 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E5D91 second address: 5E5D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E495E second address: 5E4970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1F10F4C3Eh 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E4970 second address: 5E4974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5E4974 second address: 5E497A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5EC04B second address: 5EC056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5EC49B second address: 5EC4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1F10F4C3Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5EC5D4 second address: 5EC5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5EBBDC second address: 5EBBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5EBBE2 second address: 5EBBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5EBBE6 second address: 5EBBEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5EBBEA second address: 5EBBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F03CC second address: 5F0400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB1F10F4C3Fh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB1F10F4C3Fh 0x00000015 jmp 00007FB1F10F4C3Bh 0x0000001a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F0400 second address: 5F041D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F041D second address: 5F0431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FB1F10F4C42h 0x0000000c jnc 00007FB1F10F4C36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F0431 second address: 5F0435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F3AC3 second address: 5F3AD5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB1F10F4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FB1F10F4C3Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F3AD5 second address: 5F3AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B685F second address: 5942CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB1F10F4C3Bh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB1F10F4C3Ah 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FB1F10F4C38h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c call dword ptr [ebp+122D1F55h] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 jnl 00007FB1F10F4C36h 0x0000003e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6901 second address: 5B6908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6DFE second address: 5B6E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6E04 second address: 5B6E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6E08 second address: 5B6E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jl 00007FB1F10F4C45h 0x00000010 jmp 00007FB1F10F4C3Fh 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop edi 0x0000001f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6E31 second address: 5B6E4B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007FB1F11658B6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov di, si 0x00000010 push D7AA72E3h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6E4B second address: 5B6E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6E4F second address: 5B6E53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B6E53 second address: 5B6E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B705E second address: 5B7062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B71AD second address: 5B71B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B71B1 second address: 5B71B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B7279 second address: 5B72CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jg 00007FB1F10F4C4Dh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB1F10F4C38h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 movzx edx, si 0x0000002c push 00000004h 0x0000002e nop 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push esi 0x00000033 pop esi 0x00000034 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B72CC second address: 5B72DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jl 00007FB1F11658BEh 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B75E2 second address: 5B75E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5B7914 second address: 5B7918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F421E second address: 5F4228 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB1F10F4C36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F4652 second address: 5F4667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jng 00007FB1F11658B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F4667 second address: 5F466C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F87FC second address: 5F8803 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5F8803 second address: 5F8834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1F10F4C46h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB1F10F4C42h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC480 second address: 5FC485 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC015 second address: 5FC02F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB1F10F4C3Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC02F second address: 5FC039 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB1F11658B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC194 second address: 5FC19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC19A second address: 5FC1A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC1A4 second address: 5FC1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC1AE second address: 5FC1CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FB1F11658C6h 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 5FC1CC second address: 5FC1D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FB1F10F4C36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 600A0C second address: 600A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6006EF second address: 60070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB1F10F4C42h 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 606197 second address: 6061B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FB1F11658C5h 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6061B7 second address: 6061D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB1F10F4C40h 0x0000000f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6061D1 second address: 6061E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FB1F11658B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 606487 second address: 6064A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB1F10F4C41h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6064A3 second address: 6064BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FB1F11658BAh 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6064BC second address: 6064E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB1F10F4C46h 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 606618 second address: 60661D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 606918 second address: 606922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB1F10F4C36h 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 606922 second address: 606950 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB1F11658B6h 0x00000008 js 00007FB1F11658B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jnl 00007FB1F11658B6h 0x0000001b jne 00007FB1F11658B6h 0x00000021 popad 0x00000022 jne 00007FB1F11658BCh 0x00000028 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 606AC8 second address: 606ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 606ACE second address: 606AEA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB1F11658B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB1F11658BEh 0x00000013 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A978 second address: 60A97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A06A second address: 60A070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A070 second address: 60A074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A074 second address: 60A078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A078 second address: 60A07E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A07E second address: 60A084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A084 second address: 60A08C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60A3C9 second address: 60A419 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FB1F11658B6h 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 jnp 00007FB1F11658B6h 0x00000019 jp 00007FB1F11658B6h 0x0000001f pop eax 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FB1F11658C2h 0x00000028 jo 00007FB1F11658CBh 0x0000002e pushad 0x0000002f popad 0x00000030 jmp 00007FB1F11658C3h 0x00000035 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60F7C9 second address: 60F7E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60F7E6 second address: 60F7EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60F7EA second address: 60F7F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60EA57 second address: 60EA61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB1F11658B6h 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60EA61 second address: 60EA76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C41h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60EECE second address: 60EED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60EED3 second address: 60EED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60EED9 second address: 60EEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60EEDF second address: 60EEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60F05F second address: 60F076 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BBh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60F076 second address: 60F081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB1F10F4C36h 0x0000000a pop eax 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60F1F2 second address: 60F21C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB1F11658C7h 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 60F21C second address: 60F221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 610E2C second address: 610E38 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB1F11658B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6176F6 second address: 61770F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB1F10F4C36h 0x0000000a popad 0x0000000b popad 0x0000000c jo 00007FB1F10F4C48h 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 617D02 second address: 617D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 617D06 second address: 617D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 617D12 second address: 617D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 617FAA second address: 617FC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FB1F10F4C3Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 618295 second address: 61829B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61829B second address: 6182C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB1F10F4C49h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6182C0 second address: 6182C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6182C6 second address: 6182CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 618848 second address: 61887D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007FB1F11658B6h 0x0000000b ja 00007FB1F11658B6h 0x00000011 jp 00007FB1F11658B6h 0x00000017 popad 0x00000018 jmp 00007FB1F11658C8h 0x0000001d popad 0x0000001e pushad 0x0000001f push ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61887D second address: 6188A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007FB1F10F4C4Eh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 618B8E second address: 618B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 618B96 second address: 618B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 618B9C second address: 618BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 618E35 second address: 618E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 618E39 second address: 618E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 619474 second address: 6194A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007FB1F10F4C40h 0x0000000d jo 00007FB1F10F4C36h 0x00000013 jl 00007FB1F10F4C36h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB1F10F4C3Ch 0x00000021 push edi 0x00000022 pop edi 0x00000023 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6194A9 second address: 6194AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CA71 second address: 61CA77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CA77 second address: 61CA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CA7C second address: 61CA82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CA82 second address: 61CA88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CA88 second address: 61CA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CC01 second address: 61CC06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CC06 second address: 61CC0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CE9E second address: 61CEA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61CEA2 second address: 61CEB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB1F10F4C3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61D169 second address: 61D16D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61D54A second address: 61D554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB1F10F4C36h 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61D554 second address: 61D565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FB1F11658B6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61D565 second address: 61D56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 61D56C second address: 61D586 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop esi 0x00000008 jmp 00007FB1F11658BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6223F8 second address: 622422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F10F4C40h 0x00000009 jmp 00007FB1F10F4C46h 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 62A281 second address: 62A285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 62ABA3 second address: 62ABA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 62ACF3 second address: 62ACFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 62AF73 second address: 62AFA5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007FB1F10F4C36h 0x00000009 jne 00007FB1F10F4C36h 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jno 00007FB1F10F4C41h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FB1F10F4C36h 0x00000021 js 00007FB1F10F4C36h 0x00000027 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 62AFA5 second address: 62AFA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 62B702 second address: 62B707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 62B707 second address: 62B70D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 631B04 second address: 631B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1F10F4C3Ah 0x00000009 popad 0x0000000a push edi 0x0000000b jo 00007FB1F10F4C36h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 63FA81 second address: 63FA90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FB1F11658B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 63FA90 second address: 63FA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 63FA94 second address: 63FAC5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB1F11658C2h 0x0000000f jmp 00007FB1F11658C5h 0x00000014 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 63FAC5 second address: 63FAE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 64245D second address: 642467 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB1F11658BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 65C797 second address: 65C7B3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB1F10F4C3Ch 0x00000008 jnc 00007FB1F10F4C36h 0x0000000e jo 00007FB1F10F4C42h 0x00000014 jbe 00007FB1F10F4C36h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 65CA1C second address: 65CA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 65D0DE second address: 65D105 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB1F10F4C36h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB1F10F4C47h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 65D105 second address: 65D109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 65D109 second address: 65D10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 65DADD second address: 65DAE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 65DAE9 second address: 65DAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 66173B second address: 66173F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 66345C second address: 66347B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FB1F10F4C3Eh 0x0000000d js 00007FB1F10F4C36h 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 js 00007FB1F10F4C36h 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 66347B second address: 663493 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB1F11658C0h 0x0000000d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 66D6B6 second address: 66D6BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 672FA8 second address: 672FB8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB1F11658B6h 0x00000008 jp 00007FB1F11658B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 672FB8 second address: 672FD8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007FB1F10F4C36h 0x00000009 pop ebx 0x0000000a jmp 00007FB1F10F4C3Fh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 672FD8 second address: 672FDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68037C second address: 6803A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FB1F10F4C3Fh 0x0000000d pop eax 0x0000000e jmp 00007FB1F10F4C3Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 683834 second address: 683838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 683838 second address: 68383E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6836DC second address: 6836E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 689BBF second address: 689BCF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB1F10F4C36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 689BCF second address: 689BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB1F11658B6h 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B50 second address: 688B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B54 second address: 688B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B62 second address: 688B68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B68 second address: 688B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B6C second address: 688B72 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B72 second address: 688B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB1F11658C5h 0x0000000d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B8F second address: 688B95 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688B95 second address: 688BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688CD0 second address: 688CFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Bh 0x00000007 push eax 0x00000008 jmp 00007FB1F10F4C44h 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 688CFB second address: 688D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 6890CF second address: 6890D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68C8E5 second address: 68C8E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68CB65 second address: 68CB6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68CB6A second address: 68CB70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68CB70 second address: 68CB99 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB1F10F4C36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 jmp 00007FB1F10F4C48h 0x00000015 pop eax 0x00000016 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68CC25 second address: 68CC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68CC32 second address: 68CC36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68CC36 second address: 68CC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 68E477 second address: 68E47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 690493 second address: 690497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 690497 second address: 6904B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB1F10F4C45h 0x0000000b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 69212E second address: 692143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB1F11658B6h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FB1F11658B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 692143 second address: 692147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 402CE0 second address: 402CE0 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push edi 0x00000007 push esi 0x00000008 imul eax, eax, 001E7319h 0x0000000e add eax, 3CFB5543h 0x00000013 rcr eax, 10h 0x00000016 add eax, esi 0x00000018 imul eax, edi 0x0000001b xor edx, edx 0x0000001d mul dword ptr [ebp+08h] 0x00000020 mov eax, edx 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 leave 0x00000026 retn 0004h 0x00000029 lea eax, dword ptr [eax+00000300h] 0x0000002f push eax 0x00000030 push 00405BFCh 0x00000035 call 00007FB1F1167285h 0x0000003a push ebp 0x0000003b mov ebp, esp 0x0000003d push ebx 0x0000003e push edi 0x0000003f push esi 0x00000040 mov edi, dword ptr [ebp+08h] 0x00000043 push 000000FFh 0x00000048 call 00007FB1F1165B8Eh 0x0000004d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920593 second address: 4920613 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FB1F10F4C3Ch 0x00000010 mov edx, esi 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FB1F10F4C47h 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b call 00007FB1F10F4C44h 0x00000020 mov di, ax 0x00000023 pop esi 0x00000024 mov esi, ebx 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a mov dl, 53h 0x0000002c push eax 0x0000002d push edx 0x0000002e pushfd 0x0000002f jmp 00007FB1F10F4C3Eh 0x00000034 or cl, FFFFFFC8h 0x00000037 jmp 00007FB1F10F4C3Bh 0x0000003c popfd 0x0000003d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920613 second address: 492062C instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB1F11658BEh 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 492073C second address: 4920762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushfd 0x00000009 jmp 00007FB1F10F4C3Eh 0x0000000e sub ch, FFFFFF98h 0x00000011 jmp 00007FB1F10F4C3Bh 0x00000016 popfd 0x00000017 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920762 second address: 49207D9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB1F11658C8h 0x00000008 add ecx, 7C1166F8h 0x0000000e jmp 00007FB1F11658BBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FB1F11658C6h 0x0000001d push eax 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FB1F11658C1h 0x00000025 add ecx, 5CFFCE46h 0x0000002b jmp 00007FB1F11658C1h 0x00000030 popfd 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49207D9 second address: 49207DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49207DD second address: 49207FE instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FB1F11658BFh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ax, dx 0x00000016 popad 0x00000017 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49207FE second address: 4920804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920804 second address: 4920808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920808 second address: 4920827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 492067A second address: 492067E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 492067E second address: 4920684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920684 second address: 492068A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 492068A second address: 492068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 492068E second address: 4920692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920692 second address: 49206BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FB1F10F4C48h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49206BA second address: 49206BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49206BE second address: 49206C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49206C4 second address: 49206DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658C2h 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49206DA second address: 49206DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490052D second address: 4900531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900531 second address: 4900537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900537 second address: 4900584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FB1F11658C6h 0x00000010 xchg eax, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB1F11658C7h 0x00000018 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900584 second address: 490058A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490058A second address: 490058E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490058E second address: 49005CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov eax, 5FBE0F13h 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 xchg eax, ecx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB1F10F4C40h 0x0000001a sbb al, FFFFFF98h 0x0000001d jmp 00007FB1F10F4C3Bh 0x00000022 popfd 0x00000023 popad 0x00000024 push esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49005CA second address: 49005CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49005CE second address: 49005E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49005E5 second address: 4900625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB1F11658BFh 0x00000009 or cx, B7BEh 0x0000000e jmp 00007FB1F11658C9h 0x00000013 popfd 0x00000014 push ecx 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900625 second address: 4900629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900629 second address: 490062F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490062F second address: 4900634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900634 second address: 49006B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB1F11658BAh 0x0000000a adc esi, 2E70F7E8h 0x00000010 jmp 00007FB1F11658BBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 sub edi, edi 0x0000001b jmp 00007FB1F11658BFh 0x00000020 test dword ptr [ebp+0Ch], FFFF0000h 0x00000027 jmp 00007FB1F11658C6h 0x0000002c jne 00007FB2633249A3h 0x00000032 pushad 0x00000033 jmp 00007FB1F11658BEh 0x00000038 mov esi, 756683C1h 0x0000003d popad 0x0000003e mov edx, dword ptr [ebp+0Ch] 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FB1F11658C3h 0x00000048 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49006B9 second address: 49006CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ecx, dword ptr [ebp+08h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, D54Ch 0x00000010 mov edx, 32B8FA38h 0x00000015 popad 0x00000016 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49006CF second address: 490070F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007FB1F11658C8h 0x0000000b sbb ecx, 44FDF498h 0x00000011 jmp 00007FB1F11658BBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push 56058169h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ecx 0x00000023 pop edi 0x00000024 push esi 0x00000025 pop ebx 0x00000026 popad 0x00000027 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490070F second address: 4900715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900715 second address: 4900719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900719 second address: 490071D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490071D second address: 4900732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 56050129h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900732 second address: 4900736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900736 second address: 490073C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490073C second address: 490074C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2240h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490074C second address: 4900768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB1F11658C7h 0x00000009 popad 0x0000000a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900768 second address: 490076E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490076E second address: 4900772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900772 second address: 4900789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB1F10F4C3Ah 0x00000012 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900789 second address: 49007B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov dx, 0F00h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d jmp 00007FB1F11658C4h 0x00000012 mov dword ptr [esp], edi 0x00000015 pushad 0x00000016 mov dl, 0Dh 0x00000018 popad 0x00000019 push 00000003h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49007B9 second address: 49007CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49007F3 second address: 490084F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB1F11658C7h 0x00000009 add eax, 1C801A4Eh 0x0000000f jmp 00007FB1F11658C9h 0x00000014 popfd 0x00000015 mov eax, 0AD5A657h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FB1F11658C4h 0x00000027 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490084F second address: 490085E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490085E second address: 49008C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007FB1F11658BEh 0x0000000f retn 0008h 0x00000012 mov dword ptr [ebp-34h], eax 0x00000015 push 00007F01h 0x0000001a push 00000000h 0x0000001c call 00007FB1F1167462h 0x00000021 jmp 00007FB1F5663019h 0x00000026 mov edi, edi 0x00000028 jmp 00007FB1F11658C0h 0x0000002d xchg eax, ebp 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FB1F11658BEh 0x00000035 or ch, FFFFFFE8h 0x00000038 jmp 00007FB1F11658BBh 0x0000003d popfd 0x0000003e push eax 0x0000003f push edx 0x00000040 push esi 0x00000041 pop edi 0x00000042 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49008C3 second address: 4900913 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FB1F10F4C49h 0x00000011 pop esi 0x00000012 pushfd 0x00000013 jmp 00007FB1F10F4C41h 0x00000018 and si, 2D66h 0x0000001d jmp 00007FB1F10F4C41h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900913 second address: 490092F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490092F second address: 4900933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900933 second address: 4900937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900937 second address: 490093D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490093D second address: 49009C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB1F11658C0h 0x00000009 jmp 00007FB1F11658C5h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FB1F11658C0h 0x00000015 adc cl, FFFFFFC8h 0x00000018 jmp 00007FB1F11658BBh 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 mov ebp, esp 0x00000023 pushad 0x00000024 mov ebx, ecx 0x00000026 mov ecx, 7CA08B37h 0x0000002b popad 0x0000002c xchg eax, ecx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FB1F11658C8h 0x00000034 add ecx, 10E91F58h 0x0000003a jmp 00007FB1F11658BBh 0x0000003f popfd 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49009C6 second address: 4900A13 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB1F10F4C44h 0x00000008 or cl, FFFFFFB8h 0x0000000b jmp 00007FB1F10F4C3Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007FB1F10F4C49h 0x0000001a xchg eax, ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 movsx edx, si 0x00000023 popad 0x00000024 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900A13 second address: 4900A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB1F11658C1h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB1F11658BAh 0x00000011 mov dword ptr [esp], edi 0x00000014 pushad 0x00000015 mov bh, ch 0x00000017 jmp 00007FB1F11658C3h 0x0000001c popad 0x0000001d sub edi, edi 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FB1F11658C2h 0x00000026 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900A65 second address: 4900AA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB1F10F4C41h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test dword ptr [ebp+0Ch], FFFF0000h 0x00000014 jmp 00007FB1F10F4C3Ch 0x00000019 jne 00007FB2632BADC5h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 movsx ebx, si 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900AA0 second address: 4900AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658C0h 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900AB4 second address: 4900AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900AB8 second address: 4900AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007FB1F11658C7h 0x00000010 mov ecx, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB1F11658C5h 0x0000001a rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900AF4 second address: 4900B3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 7D0A9AD1h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FB1F10F4C48h 0x00000017 sbb ch, 00000018h 0x0000001a jmp 00007FB1F10F4C3Bh 0x0000001f popfd 0x00000020 movzx esi, bx 0x00000023 popad 0x00000024 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900B3D second address: 4900B52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658C1h 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900B52 second address: 4900B66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 7D0A1A91h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900B66 second address: 4900B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB1F11658C4h 0x0000000a xor esi, 74C6FBD8h 0x00000010 jmp 00007FB1F11658BBh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900B92 second address: 4900B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900B98 second address: 4900BB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FB1F11658BCh 0x0000000e mov dword ptr [esp], edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx edi, cx 0x00000017 popad 0x00000018 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900BB7 second address: 4900C0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov ax, AA7Bh 0x0000000f mov di, ax 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FB1F10F4C46h 0x0000001c pushfd 0x0000001d jmp 00007FB1F10F4C42h 0x00000022 adc cx, 0228h 0x00000027 jmp 00007FB1F10F4C3Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900C0F second address: 4900C4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 call 00007FB1F11658BBh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FB1F11658C0h 0x00000018 adc cx, 4FB8h 0x0000001d jmp 00007FB1F11658BBh 0x00000022 popfd 0x00000023 movzx esi, dx 0x00000026 popad 0x00000027 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900C4D second address: 4900C53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900C53 second address: 4900C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900C57 second address: 4900C5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490010C second address: 490014F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB1F11658BFh 0x00000009 sub ecx, 63200BBEh 0x0000000f jmp 00007FB1F11658C9h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub edx, edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov di, cx 0x00000022 mov edx, ecx 0x00000024 popad 0x00000025 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490014F second address: 4900171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900171 second address: 4900175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900175 second address: 490017B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490017B second address: 4900181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900181 second address: 4900185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900185 second address: 49001B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB1F11658BEh 0x00000013 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49001B0 second address: 49001D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB1F10F4C45h 0x00000011 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49001D7 second address: 49001DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49001DD second address: 49002B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FB1F10F4C44h 0x0000000e mov dword ptr [esp], edi 0x00000011 jmp 00007FB1F10F4C40h 0x00000016 push 00000009h 0x00000018 jmp 00007FB1F10F4C40h 0x0000001d pop ecx 0x0000001e jmp 00007FB1F10F4C40h 0x00000023 lea esi, dword ptr [eax+04h] 0x00000026 pushad 0x00000027 call 00007FB1F10F4C3Eh 0x0000002c mov ax, 9341h 0x00000030 pop ecx 0x00000031 pushfd 0x00000032 jmp 00007FB1F10F4C47h 0x00000037 sbb si, 8B6Eh 0x0000003c jmp 00007FB1F10F4C49h 0x00000041 popfd 0x00000042 popad 0x00000043 mov eax, dword ptr [eax] 0x00000045 pushad 0x00000046 mov di, ax 0x00000049 pushfd 0x0000004a jmp 00007FB1F10F4C48h 0x0000004f and eax, 721E7218h 0x00000055 jmp 00007FB1F10F4C3Bh 0x0000005a popfd 0x0000005b popad 0x0000005c push 00000001h 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49002B9 second address: 49002BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49002BD second address: 49002C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49002C1 second address: 49002C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4900465 second address: 490046E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 8F02h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 490046E second address: 4920007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop edi 0x00000008 jmp 00007FB1F11658BFh 0x0000000d pop esi 0x0000000e jmp 00007FB1F11658C6h 0x00000013 mov esp, ebp 0x00000015 jmp 00007FB1F11658C0h 0x0000001a pop ebp 0x0000001b jmp 00007FB1F11658C0h 0x00000020 retn 0004h 0x00000023 push 00000000h 0x00000025 push dword ptr [ebp-04h] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push 00000096h 0x00000031 push 000001F4h 0x00000036 push FFFFFC18h 0x0000003b push FFFFFC18h 0x00000040 push 00C80000h 0x00000045 lea eax, dword ptr [ebp-0000014Ch] 0x0000004b push eax 0x0000004c lea eax, dword ptr [ebp-0000024Ch] 0x00000052 push eax 0x00000053 push 00000080h 0x00000058 call 00007FB1F11673EBh 0x0000005d jmp 00007FB1F56827B6h 0x00000062 mov edi, edi 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920007 second address: 492000E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 492000E second address: 4920014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920014 second address: 4920041 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d jmp 00007FB1F10F4C3Ch 0x00000012 movzx eax, dx 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dh, 8Bh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920041 second address: 4920046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920046 second address: 492013D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB1F10F4C47h 0x00000008 pop eax 0x00000009 mov bh, 28h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 mov cx, 2379h 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov ch, C8h 0x0000001d pushfd 0x0000001e jmp 00007FB1F10F4C47h 0x00000023 add ecx, 0005DE1Eh 0x00000029 jmp 00007FB1F10F4C49h 0x0000002e popfd 0x0000002f popad 0x00000030 sub eax, eax 0x00000032 jmp 00007FB1F10F4C47h 0x00000037 mov edx, dword ptr [ebp+0Ch] 0x0000003a jmp 00007FB1F10F4C46h 0x0000003f nop 0x00000040 jmp 00007FB1F10F4C40h 0x00000045 push eax 0x00000046 jmp 00007FB1F10F4C3Bh 0x0000004b nop 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f pushfd 0x00000050 jmp 00007FB1F10F4C3Bh 0x00000055 add ax, 92EEh 0x0000005a jmp 00007FB1F10F4C49h 0x0000005f popfd 0x00000060 jmp 00007FB1F10F4C40h 0x00000065 popad 0x00000066 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 492013D second address: 49201C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushfd 0x00000007 jmp 00007FB1F11658BDh 0x0000000c jmp 00007FB1F11658BBh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 nop 0x00000016 jmp 00007FB1F11658C6h 0x0000001b push eax 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FB1F11658BDh 0x00000023 or eax, 79A92DE6h 0x00000029 jmp 00007FB1F11658C1h 0x0000002e popfd 0x0000002f popad 0x00000030 nop 0x00000031 jmp 00007FB1F11658BEh 0x00000036 push 3DEAE92Ah 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FB1F11658BCh 0x00000042 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49201C2 second address: 49201EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 7DEAE92Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB1F10F4C40h 0x00000019 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49201EC second address: 49201F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49201F0 second address: 49201F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49201F6 second address: 4920267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov cl, 56h 0x0000000d jmp 00007FB1F11658C3h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 pushad 0x00000016 movsx ebx, ax 0x00000019 call 00007FB1F11658BEh 0x0000001e pop eax 0x0000001f popad 0x00000020 mov eax, edx 0x00000022 popad 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov eax, 7C87B925h 0x0000002c pushfd 0x0000002d jmp 00007FB1F11658C2h 0x00000032 add cx, 7638h 0x00000037 jmp 00007FB1F11658BBh 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4920267 second address: 4920375 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+34h] 0x0000000c jmp 00007FB1F10F4C3Eh 0x00000011 mov ecx, dword ptr [ebp+08h] 0x00000014 jmp 00007FB1F10F4C40h 0x00000019 push dword ptr [ebp+30h] 0x0000001c pushad 0x0000001d call 00007FB1F10F4C3Eh 0x00000022 mov esi, 05E6BB41h 0x00000027 pop ecx 0x00000028 mov ebx, 49307D72h 0x0000002d popad 0x0000002e push dword ptr [ebp+2Ch] 0x00000031 jmp 00007FB1F10F4C49h 0x00000036 push dword ptr [ebp+28h] 0x00000039 jmp 00007FB1F10F4C3Eh 0x0000003e push dword ptr [ebp+24h] 0x00000041 jmp 00007FB1F10F4C40h 0x00000046 push dword ptr [ebp+20h] 0x00000049 pushad 0x0000004a mov edx, esi 0x0000004c pushfd 0x0000004d jmp 00007FB1F10F4C3Ah 0x00000052 jmp 00007FB1F10F4C45h 0x00000057 popfd 0x00000058 popad 0x00000059 push dword ptr [ebp+1Ch] 0x0000005c jmp 00007FB1F10F4C3Eh 0x00000061 push dword ptr [ebp+18h] 0x00000064 pushad 0x00000065 pushad 0x00000066 mov cl, 81h 0x00000068 pushad 0x00000069 popad 0x0000006a popad 0x0000006b mov edx, 0A31D29Ah 0x00000070 popad 0x00000071 push dword ptr [ebp+14h] 0x00000074 jmp 00007FB1F10F4C41h 0x00000079 push dword ptr [ebp+10h] 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007FB1F10F4C3Dh 0x00000083 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910BF2 second address: 4910BF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910BF6 second address: 4910BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910BFC second address: 4910C59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov di, cx 0x0000000f mov edx, ecx 0x00000011 popad 0x00000012 call 00007FB1F11658C4h 0x00000017 jmp 00007FB1F11658C2h 0x0000001c pop ecx 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FB1F11658C7h 0x00000026 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910C59 second address: 4910CB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 call 00007FB1F10F4C3Bh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FB1F10F4C45h 0x00000016 jmp 00007FB1F10F4C3Bh 0x0000001b popfd 0x0000001c pushad 0x0000001d mov ebx, eax 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 movzx eax, dx 0x00000029 movsx edx, cx 0x0000002c popad 0x0000002d push 00000001h 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FB1F10F4C3Ah 0x00000038 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910CB2 second address: 4910CB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910CB8 second address: 4910CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov ebx, esi 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910CD1 second address: 4910CE8 instructions: 0x00000000 rdtsc 0x00000002 mov edx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB1F11658BCh 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910CE8 second address: 4910DAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB1F10F4C41h 0x00000009 or esi, 7A378CE6h 0x0000000f jmp 00007FB1F10F4C41h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FB1F10F4C40h 0x0000001b jmp 00007FB1F10F4C45h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 push dword ptr [ebp+0Ch] 0x00000027 jmp 00007FB1F10F4C3Eh 0x0000002c sub edx, edx 0x0000002e pushad 0x0000002f mov si, dx 0x00000032 mov si, di 0x00000035 popad 0x00000036 mov ecx, 00000000h 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007FB1F10F4C47h 0x00000044 add ax, 02DEh 0x00000049 jmp 00007FB1F10F4C49h 0x0000004e popfd 0x0000004f jmp 00007FB1F10F4C40h 0x00000054 popad 0x00000055 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910081 second address: 4910086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910086 second address: 49100EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB1F10F4C3Ch 0x0000000a xor si, 8778h 0x0000000f jmp 00007FB1F10F4C3Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 jmp 00007FB1F10F4C49h 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 pushad 0x00000021 mov bx, ax 0x00000024 mov esi, 4F711725h 0x00000029 popad 0x0000002a call 00007FB1F10F4C42h 0x0000002f mov ebx, esi 0x00000031 pop esi 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49100EF second address: 49100F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49100F3 second address: 49100F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49100F9 second address: 49100FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49100FF second address: 4910103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910103 second address: 4910125 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [76B14C30h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB1F11658C2h 0x00000015 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910125 second address: 491012A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 491012A second address: 4910151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jmp 00007FB1F11658C6h 0x0000000d mov dword ptr [esp], ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov si, di 0x00000016 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910151 second address: 49101B2 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, esi 0x00000009 jmp 00007FB1F10F4C3Eh 0x0000000e push eax 0x0000000f jmp 00007FB1F10F4C3Bh 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push edi 0x00000019 pop ecx 0x0000001a pushfd 0x0000001b jmp 00007FB1F10F4C47h 0x00000020 add ax, BF7Eh 0x00000025 jmp 00007FB1F10F4C49h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49101B2 second address: 491020C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB1F11658C7h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FB1F11658C9h 0x0000000f sub ax, 3316h 0x00000014 jmp 00007FB1F11658C1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d sub ebx, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov ah, 7Ah 0x00000024 mov cx, di 0x00000027 popad 0x00000028 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 491020C second address: 4910225 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910225 second address: 4910242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910242 second address: 4910293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB1F10F4C47h 0x00000008 pushfd 0x00000009 jmp 00007FB1F10F4C48h 0x0000000e or eax, 39E2FE58h 0x00000014 jmp 00007FB1F10F4C3Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910293 second address: 49102F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB1F11658BDh 0x00000009 sub esi, 6A5ED9F6h 0x0000000f jmp 00007FB1F11658C1h 0x00000014 popfd 0x00000015 movzx esi, dx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, edi 0x0000001c jmp 00007FB1F11658C3h 0x00000021 mov edi, dword ptr [ebp+08h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB1F11658C5h 0x0000002b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49102F0 second address: 4910317 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, di 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB1F10F4C3Dh 0x00000013 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910317 second address: 4910327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658BCh 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910327 second address: 4910355 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp ebx, dword ptr [ecx+0Ch] 0x0000000b jmp 00007FB1F10F4C47h 0x00000010 jc 00007FB26328EF6Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910355 second address: 4910370 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910370 second address: 4910376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910376 second address: 491037A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 491037A second address: 49103C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FB26328EFAFh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007FB1F10F4C48h 0x00000016 pushfd 0x00000017 jmp 00007FB1F10F4C42h 0x0000001c xor cx, 9158h 0x00000021 jmp 00007FB1F10F4C3Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0098 second address: 48F009C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F009C second address: 48F00A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F00A2 second address: 48F00D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB1F11658C7h 0x00000012 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F00D3 second address: 48F0153 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 63h 0x00000005 mov di, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-1Ch], esi 0x0000000e jmp 00007FB1F10F4C3Ah 0x00000013 mov ecx, ebx 0x00000015 jmp 00007FB1F10F4C40h 0x0000001a or ecx, esi 0x0000001c pushad 0x0000001d mov cx, 71FDh 0x00000021 pushad 0x00000022 movzx ecx, bx 0x00000025 jmp 00007FB1F10F4C45h 0x0000002a popad 0x0000002b popad 0x0000002c je 00007FB263298858h 0x00000032 jmp 00007FB1F10F4C3Eh 0x00000037 and dword ptr [ebp-04h], 00000000h 0x0000003b pushad 0x0000003c mov edx, ecx 0x0000003e movzx esi, di 0x00000041 popad 0x00000042 mov edi, dword ptr [ebp+10h] 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FB1F10F4C40h 0x0000004c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0153 second address: 48F0159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0159 second address: 48F01C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edi, edi 0x0000000a jmp 00007FB1F10F4C49h 0x0000000f je 00007FB2632987E0h 0x00000015 jmp 00007FB1F10F4C3Eh 0x0000001a mov ecx, dword ptr [ebx+00000080h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 movsx edx, cx 0x00000026 pushfd 0x00000027 jmp 00007FB1F10F4C46h 0x0000002c or esi, 7D778B88h 0x00000032 jmp 00007FB1F10F4C3Bh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F01C6 second address: 48F0220 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebx+00000084h] 0x0000000f pushad 0x00000010 mov eax, 6214C083h 0x00000015 pushfd 0x00000016 jmp 00007FB1F11658C8h 0x0000001b xor cl, 00000048h 0x0000001e jmp 00007FB1F11658BBh 0x00000023 popfd 0x00000024 popad 0x00000025 mov eax, ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0220 second address: 48F0224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0224 second address: 48F023F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F023F second address: 48F0245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0245 second address: 48F0249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F029B second address: 48F0318 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB1F10F4C40h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov di, si 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FB1F10F4C46h 0x0000001b mov ebp, esp 0x0000001d jmp 00007FB1F10F4C40h 0x00000022 mov ecx, dword ptr [ebp+08h] 0x00000025 jmp 00007FB1F10F4C40h 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FB1F10F4C47h 0x00000032 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0318 second address: 48F0330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658C4h 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0330 second address: 48F0374 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov si, 5B63h 0x0000000e pushfd 0x0000000f jmp 00007FB1F10F4C48h 0x00000014 and esi, 7B4C15A8h 0x0000001a jmp 00007FB1F10F4C3Bh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov dh, 57h 0x00000027 mov dx, cx 0x0000002a popad 0x0000002b rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0399 second address: 48F039D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F039D second address: 48F03A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F03A3 second address: 48F03A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F03A9 second address: 48F03AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F03AD second address: 48F03C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, bx 0x00000010 movsx edx, si 0x00000013 popad 0x00000014 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F03C1 second address: 48F03C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F03C7 second address: 48F0479 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F11658BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, esi 0x0000000d jmp 00007FB1F11658C6h 0x00000012 or ecx, edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FB1F11658BEh 0x0000001b sub cx, 8258h 0x00000020 jmp 00007FB1F11658BBh 0x00000025 popfd 0x00000026 mov esi, 610ACB0Fh 0x0000002b popad 0x0000002c je 00007FB2633199B8h 0x00000032 pushad 0x00000033 mov si, 0D07h 0x00000037 mov ax, 72A3h 0x0000003b popad 0x0000003c mov eax, dword ptr [esi+00000088h] 0x00000042 pushad 0x00000043 mov ax, 931Bh 0x00000047 pushfd 0x00000048 jmp 00007FB1F11658C0h 0x0000004d add eax, 5A5B13E8h 0x00000053 jmp 00007FB1F11658BBh 0x00000058 popfd 0x00000059 popad 0x0000005a or eax, dword ptr [esi+0000008Ch] 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FB1F11658C5h 0x00000067 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F0479 second address: 48F047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 48F047F second address: 491041A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB26331992Bh 0x0000000d jne 00007FB1F11658C3h 0x0000000f test byte ptr [esi+11h], 00000010h 0x00000013 jne 00007FB1F11658BDh 0x00000015 mov eax, dword ptr [esi+38h] 0x00000018 or eax, dword ptr [esi+3Ch] 0x0000001b jne 00007FB1F11658B5h 0x0000001d inc eax 0x0000001e jmp 00007FB1F11658BDh 0x00000020 pop esi 0x00000021 pop ebp 0x00000022 retn 0004h 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b lea eax, dword ptr [ebp-20h] 0x0000002e push eax 0x0000002f call 00007FB1F11673E5h 0x00000034 jmp 00007FB1F5672B7Fh 0x00000039 mov edi, edi 0x0000003b pushad 0x0000003c jmp 00007FB1F11658BEh 0x00000041 call 00007FB1F11658C2h 0x00000046 pushad 0x00000047 popad 0x00000048 pop eax 0x00000049 popad 0x0000004a push edx 0x0000004b pushad 0x0000004c pushad 0x0000004d mov cx, 03EBh 0x00000051 popad 0x00000052 push eax 0x00000053 push edx 0x00000054 mov edi, eax 0x00000056 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 491041A second address: 4910454 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007FB1F10F4C44h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB1F10F4C47h 0x00000019 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910454 second address: 491046C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658C4h 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 491046C second address: 49104D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+10h] 0x0000000b jmp 00007FB1F10F4C47h 0x00000010 sub esp, 20h 0x00000013 jmp 00007FB1F10F4C46h 0x00000018 mov ecx, dword ptr [ebp+14h] 0x0000001b pushad 0x0000001c jmp 00007FB1F10F4C3Eh 0x00000021 mov ax, 3ED1h 0x00000025 popad 0x00000026 mov eax, edx 0x00000028 pushad 0x00000029 mov ebx, ecx 0x0000002b popad 0x0000002c or eax, ecx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FB1F10F4C3Eh 0x00000035 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49104D6 second address: 49104E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB1F11658BEh 0x00000009 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 49104E8 second address: 491057A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FB1F10F4C3Ch 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007FB1F10F4C40h 0x00000016 mov esi, FFFE0000h 0x0000001b pushad 0x0000001c mov di, si 0x0000001f mov esi, 64850239h 0x00000024 popad 0x00000025 xchg eax, edi 0x00000026 jmp 00007FB1F10F4C44h 0x0000002b push eax 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FB1F10F4C41h 0x00000033 jmp 00007FB1F10F4C3Bh 0x00000038 popfd 0x00000039 call 00007FB1F10F4C48h 0x0000003e mov ch, C5h 0x00000040 pop edx 0x00000041 popad 0x00000042 xchg eax, edi 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 movsx ebx, si 0x00000049 mov ah, EEh 0x0000004b popad 0x0000004c rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 491057A second address: 4910580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeRDTSC instruction interceptor: First address: 4910580 second address: 4910611 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB1F10F4C44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007FB1F10F4C46h 0x00000018 sbb ecx, 3670F1C8h 0x0000001e jmp 00007FB1F10F4C3Bh 0x00000023 popfd 0x00000024 popad 0x00000025 jne 00007FB2632A004Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov dx, 6836h 0x00000032 pushfd 0x00000033 jmp 00007FB1F10F4C47h 0x00000038 xor esi, 5A8BD0BEh 0x0000003e jmp 00007FB1F10F4C49h 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
          Tries to evade debugger and weak emulator (self modifying code)
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSpecial instruction interceptor: First address: 40BAD1 instructions caused by: Self-modifying code
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSpecial instruction interceptor: First address: 40BBC7 instructions caused by: Self-modifying code
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSpecial instruction interceptor: First address: 5A6AA0 instructions caused by: Self-modifying code
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSpecial instruction interceptor: First address: 5CCFE7 instructions caused by: Self-modifying code
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSpecial instruction interceptor: First address: 5B695C instructions caused by: Self-modifying code
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSpecial instruction interceptor: First address: 6334C2 instructions caused by: Self-modifying code
          Source: C:\ProgramData\hkij\lfaslh.exeSpecial instruction interceptor: First address: 40BAD1 instructions caused by: Self-modifying code
          Source: C:\ProgramData\hkij\lfaslh.exeSpecial instruction interceptor: First address: 40BBC7 instructions caused by: Self-modifying code
          Source: C:\ProgramData\hkij\lfaslh.exeSpecial instruction interceptor: First address: 5A6AA0 instructions caused by: Self-modifying code
          Source: C:\ProgramData\hkij\lfaslh.exeSpecial instruction interceptor: First address: 5CCFE7 instructions caused by: Self-modifying code
          Source: C:\ProgramData\hkij\lfaslh.exeSpecial instruction interceptor: First address: 5B695C instructions caused by: Self-modifying code
          Source: C:\ProgramData\hkij\lfaslh.exeSpecial instruction interceptor: First address: 6334C2 instructions caused by: Self-modifying code
          Source: C:\ProgramData\hkij\lfaslh.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeCode function: 0_2_04910C69 rdtsc 0_2_04910C69
          Source: C:\ProgramData\hkij\lfaslh.exeWindow / User API: threadDelayed 1315Jump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow / User API: threadDelayed 1371Jump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeWindow / User API: threadDelayed 1305Jump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe TID: 6712Thread sleep count: 83 > 30Jump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe TID: 6712Thread sleep count: 82 > 30Jump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe TID: 6712Thread sleep count: 79 > 30Jump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe TID: 6712Thread sleep count: 69 > 30Jump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe TID: 6712Thread sleep count: 143 > 30Jump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe TID: 6712Thread sleep time: -60000s >= -30000sJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exe TID: 6944Thread sleep time: -76038s >= -30000sJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exe TID: 6948Thread sleep time: -80040s >= -30000sJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exe TID: 6908Thread sleep time: -60000s >= -30000sJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exe TID: 6928Thread sleep time: -2631315s >= -30000sJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exe TID: 6936Thread sleep time: -2743371s >= -30000sJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exe TID: 6920Thread sleep time: -2611305s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeThread delayed: delay time: 60000Jump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeThread delayed: delay time: 60000Jump to behavior
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe, SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe, 00000000.00000002.2407547128.0000000000584000.00000040.00000001.01000000.00000003.sdmp, lfaslh.exe, lfaslh.exe, 00000002.00000002.4842982020.0000000000584000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe, 00000000.00000002.2407547128.0000000000584000.00000040.00000001.01000000.00000003.sdmp, lfaslh.exe, 00000002.00000002.4842982020.0000000000584000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
          Source: lfaslh.exe, 00000002.00000002.4843909516.00000000009CA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeSystem information queried: ModuleInformationJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeProcess information queried: ProcessInformationJump to behavior

          Anti Debugging

          barindex
          Hides threads from debuggers
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeThread information set: HideFromDebuggerJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeThread information set: HideFromDebuggerJump to behavior
          Tries to detect sandboxes and other dynamic analysis tools (window names)
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: regmonclass
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: gbdyllo
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: procmon_window_class
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: ollydbg
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: filemonclass
          Source: C:\ProgramData\hkij\lfaslh.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
          Source: C:\ProgramData\hkij\lfaslh.exeFile opened: NTICE
          Source: C:\ProgramData\hkij\lfaslh.exeFile opened: SICE
          Source: C:\ProgramData\hkij\lfaslh.exeFile opened: SIWVID
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeProcess queried: DebugPortJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeProcess queried: DebugPortJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeProcess queried: DebugPortJump to behavior
          Source: C:\ProgramData\hkij\lfaslh.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exeCode function: 0_2_04910C69 rdtsc 0_2_04910C69
          Source: C:\ProgramData\hkij\lfaslh.exeCode function: 2_2_00402D09 LdrLoadDll,2_2_00402D09
          Source: C:\ProgramData\hkij\lfaslh.exeCode function: 2_2_00402D09 mov eax, dword ptr fs:[00000030h]2_2_00402D09
          Source: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe, SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe, 00000000.00000002.2407547128.0000000000584000.00000040.00000001.01000000.00000003.sdmp, lfaslh.exe, lfaslh.exe, 00000002.00000002.4842982020.0000000000584000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: Program Manager

          Stealing of Sensitive Information

          barindex
          Yara detected SystemBC
          Source: Yara matchFile source: 00000000.00000003.2399961206.0000000004764000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000003.2429373659.0000000004784000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe PID: 6708, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: lfaslh.exe PID: 6904, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Yara detected SystemBC
          Source: Yara matchFile source: 00000000.00000003.2399961206.0000000004764000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000003.2429373659.0000000004784000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe PID: 6708, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: lfaslh.exe PID: 6904, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
          Command and Scripting Interpreter          		1
          Scheduled Task/Job          		2
          Process Injection          		1
          Masquerading          		OS Credential Dumping741
          Security Software Discovery          		Remote ServicesData from Local System1
          Web Service          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Scheduled Task/Job          		1
          DLL Side-Loading          		1
          Scheduled Task/Job          		241
          Virtualization/Sandbox Evasion          		LSASS Memory2
          Process Discovery          		Remote Desktop ProtocolData from Removable Media2
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
          DLL Side-Loading          		2
          Process Injection          		Security Account Manager241
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared Drive1
          Non-Standard Port          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
          Obfuscated Files or Information          		NTDS1
          Application Window Discovery          		Distributed Component Object ModelInput Capture1
          Ingress Tool Transfer          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
          Software Packing          		LSA Secrets22
          System Information Discovery          		SSHKeylogging2
          Non-Application Layer Protocol          		Scheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          DLL Side-Loading          		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input Capture123
          Application Layer Protocol          		Data Transfer Size LimitsService Stop

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.