thwarted our attempts to attach debuggers. Since it did not include anti-VM code, we ran it in TEMU, an x86 emulator designed for malware analysis [29]. TEMU captures instructionlevel execution traces and provides support for taint-tracking.