Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll

Overview

General Information

Sample Name:SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll
Analysis ID:1280994
MD5:d4257a85611eb9b8fc7da98ad7cd3b4c
SHA1:10a8821bd70d4afa52388ca04480085b98ac9227
SHA256:a7d13b0ae56c9d7759c0c20a5ea515760dffa8ea4fa366f9092e901b4579499b
Tags:dll
Infos:

Detection

Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Hides threads from debuggers
Creates an autostart registry key pointing to binary in C:\Windows
PE file has a writeable .text section
Tries to evade debugger and weak emulator (self modifying code)
Machine Learning detection for sample
Tries to detect virtualization through RDTSC time measurements
Uses 32bit PE files
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
IP address seen in connection with other malware
Entry point lies outside standard sections
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Installs a raw input device (often for capturing keystrokes)
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Yara detected Keylogger Generic
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 7248 cmdline: loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll" MD5: 3B4636AE519868037940CA5C4272091B)
    • conhost.exe (PID: 7256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 7284 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 7304 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 7728 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 740 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
    • rundll32.exe (PID: 7292 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_Parse MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7340 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTuple MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7356 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTupleAndKeywords MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7916 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_Parse MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7952 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTuple MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7960 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTupleAndKeywords MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7968 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7976 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7984 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • rundll32.exe (PID: 7348 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • rundll32.exe (PID: 4956 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
    00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
      0000000E.00000003.525120139.00000000049F8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
        0000000D.00000003.524835873.0000000004C18000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
          0000000F.00000003.524953434.0000000004B75000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            Click to see the 14 entries

            Sigma Signatures

            ⊘No Sigma rule has matched

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllReversingLabs: Detection: 57%
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllVirustotal: Detection: 62%Perma Link
            Antivirus detection for URL or domain
            Source: https://ebaoffice.com.br/imagens/bo/inspecionando.phpAvira URL Cloud: Label: malware
            Machine Learning detection for sample
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllJoe Sandbox ML: detected
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
            Source: unknownHTTPS traffic detected: 187.45.187.42:443 -> 192.168.2.3:49700 version: TLS 1.2
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: iphlpapi.pdbUGP source: loaddll32.exe, 00000000.00000002.748405269.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.00000000047FA000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.394791347.000000000090C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.000000000432A000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernel32.pdb source: loaddll32.exe, 00000000.00000002.748233445.0000000002AB5000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762100098.00000000044CE000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.386065735.0000000004322000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.385395831.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.631130628.0000000004210000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: advapi32.pdbUGP source: loaddll32.exe, 00000000.00000002.748405269.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.0000000004790000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.00000000042C0000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: iphlpapi.pdb source: loaddll32.exe, 00000000.00000002.748405269.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.00000000047FA000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.394791347.000000000090C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.000000000432A000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernelbase.pdb source: loaddll32.exe, 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763552104.0000000004983000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.410153829.0000000002A4A000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.748543816.0000000002C4B000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762241390.00000000045F6000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.378458232.0000000004457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.378147790.00000000042C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.633400699.0000000004466000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.410153829.0000000002A4A000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.748543816.0000000002C4B000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762241390.00000000045F6000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.378458232.0000000004457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.378147790.00000000042C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.633400699.0000000004466000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wuser32.pdb source: loaddll32.exe, 00000000.00000003.425768048.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.749181880.0000000003173000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764406346.0000000004B7F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.634822805.000000000460A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.411281067.0000000005254000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernelbase.pdbUGP source: loaddll32.exe, 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763552104.0000000004983000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: advapi32.pdb source: loaddll32.exe, 00000000.00000002.748405269.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.0000000004790000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.00000000042C0000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernel32.pdbGCTL source: loaddll32.exe, 00000000.00000002.748233445.0000000002AB5000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762100098.00000000044CE000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.386065735.0000000004322000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.385395831.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.631130628.0000000004210000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wuser32.pdbUGP source: loaddll32.exe, 00000000.00000003.425768048.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.749181880.0000000003173000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764406346.0000000004B7F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.634822805.000000000460A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.411281067.0000000005254000.00000004.00000800.00020000.00000000.sdmp

            Networking

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 15.228.77.178 80Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeDomain query: ebaoffice.com.br
            Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 187.45.187.42 443Jump to behavior
            Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: Joe Sandbox ViewIP Address: 15.228.77.178 15.228.77.178
            Source: global trafficHTTP traffic detected: GET /imagens/bo/inspecionando.php HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ebaoffice.com.brConnection: Keep-Alive
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
            Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
            Source: unknownTCP traffic detected without corresponding DNS query: 15.228.77.178
            Source: unknownTCP traffic detected without corresponding DNS query: 15.228.77.178
            Source: unknownTCP traffic detected without corresponding DNS query: 15.228.77.178
            Source: rundll32.exe, 00000003.00000003.468135490.00000000009A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: loaddll32.exe, 00000000.00000003.742798207.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764773351.0000000004DA0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.637919111.000000006AAA9000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.637334819.0000000004A80000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.indyproject.org/
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/
            Source: rundll32.exe, 00000003.00000002.766643170.0000000006B30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/(
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/E
            Source: rundll32.exe, 00000003.00000002.766643170.0000000006B30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.637919111.000000006A6A1000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.496695244.0000000003447000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.php
            Source: rundll32.exe, 00000003.00000002.761369854.000000000097E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.php)D0o
            Source: rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.php-
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.761369854.000000000098D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.php...
            Source: rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.php2
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.php7&
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phpHistory.IE5
            Source: rundll32.exe, 00000005.00000002.496695244.0000000003447000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phpM
            Source: rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phph
            Source: rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phpp
            Source: rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phpph
            Source: rundll32.exe, 00000003.00000002.761369854.000000000097E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phps/bo/inspecionando.phpo.php8
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phptCookies
            Source: rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phptigs
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebaoffice.com.br/imagens/bo/inspecionando.phpx
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
            Source: unknownDNS traffic detected: queries for: ebaoffice.com.br
            Source: global trafficHTTP traffic detected: GET /imagens/bo/inspecionando.php HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ebaoffice.com.brConnection: Keep-Alive
            Source: unknownHTTPS traffic detected: 187.45.187.42:443 -> 192.168.2.3:49700 version: TLS 1.2
            Source: loaddll32.exe, 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: DirectInput8Create
            Source: loaddll32.exe, 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: GetRawInputData
            Source: Yara matchFile source: 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.525120139.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000003.524835873.0000000004C18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000003.524953434.0000000004B75000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000003.525296608.0000000004769000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.631051059.0000000004C02000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.643065944.0000000004BE0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000011.00000002.639239677.000000000512E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.640120125.0000000004EC6000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.497484084.0000000005440000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.644122819.000000000495B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.642962104.0000000004E03000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000F.00000002.632355714.0000000004D6A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000011.00000003.525729460.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.763552104.0000000004983000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 7248, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7292, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7304, type: MEMORYSTR

            System Summary

            barindex
            PE file has a writeable .text section
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
            Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 740
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A522140_2_02A52214
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7FF230_2_02A7FF23
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FF1F0_2_02A4FF1F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7F4CA0_2_02A7F4CA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55D740_2_02A55D74
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A59AB40_2_02A59AB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5B3990_2_02A5B399
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446ADC53_2_0446ADC5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449807B3_2_0449807B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E9253_2_0446E925
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468AD03_2_04468AD0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04498AD43_2_04498AD4
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044726653_2_04472665
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04473F4A3_2_04473F4A
            Source: C:\Windows\System32\loaddll32.exeCode function: String function: 02AA5F28 appears 33 times
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 044BEAD9 appears 33 times
            Source: C:\Windows\System32\loaddll32.exeSection loaded: security.dllJump to behavior
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllReversingLabs: Detection: 57%
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllVirustotal: Detection: 62%
            Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll"
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_Parse
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTuple
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTupleAndKeywords
            Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 740
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_Parse
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTuple
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTupleAndKeywords
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr
            Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
            Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1Jump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTupleJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTupleAndKeywords Jump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTupleJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTupleAndKeywords Jump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddrJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddrJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddrJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4Jump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2827.tmpJump to behavior
            Source: classification engineClassification label: mal88.evad.winDLL@27/7@1/3
            Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
            Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_Parse
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:120:WilError_01
            Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7304
            Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: Virtual size of .text is bigger than: 0x100000
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic file information: File size 7131136 > 1048576
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x502e00
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: Raw size of .sedata is bigger than: 0x100000 < 0x1c7e00
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: iphlpapi.pdbUGP source: loaddll32.exe, 00000000.00000002.748405269.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.00000000047FA000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.394791347.000000000090C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.000000000432A000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernel32.pdb source: loaddll32.exe, 00000000.00000002.748233445.0000000002AB5000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762100098.00000000044CE000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.386065735.0000000004322000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.385395831.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.631130628.0000000004210000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: advapi32.pdbUGP source: loaddll32.exe, 00000000.00000002.748405269.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.0000000004790000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.00000000042C0000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: iphlpapi.pdb source: loaddll32.exe, 00000000.00000002.748405269.0000000002B9A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.00000000047FA000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.394791347.000000000090C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.000000000432A000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernelbase.pdb source: loaddll32.exe, 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763552104.0000000004983000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.410153829.0000000002A4A000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.748543816.0000000002C4B000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762241390.00000000045F6000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.378458232.0000000004457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.378147790.00000000042C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.633400699.0000000004466000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.410153829.0000000002A4A000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.748543816.0000000002C4B000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762241390.00000000045F6000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.378458232.0000000004457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.378147790.00000000042C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.633400699.0000000004466000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wuser32.pdb source: loaddll32.exe, 00000000.00000003.425768048.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.749181880.0000000003173000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764406346.0000000004B7F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.634822805.000000000460A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.411281067.0000000005254000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernelbase.pdbUGP source: loaddll32.exe, 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763552104.0000000004983000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: advapi32.pdb source: loaddll32.exe, 00000000.00000002.748405269.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.763154748.0000000004790000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.632808277.00000000042C0000.00000040.00000800.00020000.00000000.sdmp
            Source: Binary string: wkernel32.pdbGCTL source: loaddll32.exe, 00000000.00000002.748233445.0000000002AB5000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.762100098.00000000044CE000.00000040.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.386065735.0000000004322000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.385395831.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.631130628.0000000004210000.00000040.00000020.00020000.00000000.sdmp
            Source: Binary string: wuser32.pdbUGP source: loaddll32.exe, 00000000.00000003.425768048.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.749181880.0000000003173000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764406346.0000000004B7F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.634822805.000000000460A000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.411281067.0000000005254000.00000004.00000800.00020000.00000000.sdmp
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02AA5F6D push ecx; ret 0_2_02AA5F80
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044BEB1E push ecx; ret 3_2_044BEB31
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: section name: .sedata
            Source: SecuriteInfo.com.Variant.Barys.394881.27394.14169.dllStatic PE information: section name: .sedata
            Source: initial sampleStatic PE information: section where entry point is pointing to: .sedata
            Source: initial sampleStatic PE information: section name: .sedata entropy: 7.114902610616691

            Boot Survival

            barindex
            Creates an autostart registry key pointing to binary in C:\Windows
            Source: C:\Windows\SysWOW64\rundll32.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run rundll32.exeJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run rundll32.exeJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run rundll32.exeJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\loaddll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Tries to evade debugger and weak emulator (self modifying code)
            Source: C:\Windows\System32\loaddll32.exeSpecial instruction interceptor: First address: 000000006C842D4C instructions caused by: Self-modifying code
            Tries to detect virtualization through RDTSC time measurements
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83EAC9 second address: 000000006C83EEF8 instructions: 0x00000000 rdtsc 0x00000002 mov dl, F2h 0x00000004 bswap ecx 0x00000006 call 00007FD448BF556Ah 0x0000000b jmp 00007FD448BF55BBh 0x0000000d lea ebx, dword ptr [ebx+55h] 0x00000010 lea ecx, dword ptr [00000000h+ebx*4] 0x00000017 bsr bp, cx 0x0000001b rcl ecx, 19h 0x0000001e xchg dword ptr [esp+04h], ebx 0x00000022 jmp 00007FD448BF59EBh 0x00000027 mov al, F1h 0x00000029 rcl bx, 1 0x0000002c inc bx 0x0000002e sub esp, 1Eh 0x00000031 ror ax, 0002h 0x00000035 lea esp, dword ptr [esp+02h] 0x00000039 jmp 00007FD448BF5550h 0x0000003b push dword ptr [esp+20h] 0x0000003f retn 0024h 0x00000042 lea edi, dword ptr [esp+0Ch] 0x00000046 mov dl, byte ptr [esp] 0x00000049 jmp 00007FD448BF59FAh 0x0000004e sub esp, 000000B4h 0x00000054 mov ebp, esp 0x00000056 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B709 second address: 000000006C84B85B instructions: 0x00000000 rdtsc 0x00000002 mov ah, byte ptr [esp] 0x00000005 jmp 00007FD448BFA10Dh 0x00000007 mov dh, byte ptr [esp] 0x0000000a jmp 00007FD448BFA120h 0x0000000c mov ecx, edi 0x0000000e mov esi, dword ptr [ecx] 0x00000010 bsf ecx, ecx 0x00000013 jnp 00007FD448BFA0D3h 0x00000015 jmp 00007FD448BFA185h 0x0000001a mov al, 96h 0x0000001c xchg edx, ecx 0x0000001e add edi, 04h 0x00000021 jmp 00007FD448BFA0A9h 0x00000023 btc edx, esi 0x00000026 je 00007FD448BFA0D7h 0x00000028 bsr eax, edi 0x0000002b setnl dh 0x0000002e jmp 00007FD448BFA10Ch 0x00000030 push ebp 0x00000031 lea ecx, dword ptr [ecx+esi] 0x00000034 call 00007FD448BFA0D2h 0x00000039 mov ch, byte ptr [esp] 0x0000003c push esi 0x0000003d jmp 00007FD448BFA172h 0x00000042 and ebp, esi 0x00000044 jns 00007FD448BFA0BEh 0x00000046 mov cx, word ptr [esp] 0x0000004a mov cl, byte ptr [esp] 0x0000004d jmp 00007FD448BFA0CFh 0x0000004f dec ax 0x00000051 push edi 0x00000052 mov dx, 9280h 0x00000056 mov dx, B8F4h 0x0000005a jmp 00007FD448BFA108h 0x0000005c mov bp, word ptr [esp] 0x00000060 sbb ax, bp 0x00000063 jmp 00007FD448BFA139h 0x00000065 jnc 00007FD448BFA0ADh 0x00000067 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B85B second address: 000000006C84B903 instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [eax+ebx] 0x00000005 jmp 00007FD448BF556Fh 0x00000007 cmp eax, 9DA45E12h 0x0000000c push si 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 jmp 00007FD448BF55BEh 0x00000014 pop esi 0x00000015 mov al, dl 0x00000017 mov al, dl 0x00000019 clc 0x0000001a jnp 00007FD448BF5574h 0x0000001c jmp 00007FD448BF5624h 0x00000021 pop ebp 0x00000022 mov ch, 2Fh 0x00000024 mov ax, BE00h 0x00000028 or eax, ebx 0x0000002a jnle 00007FD448BF5551h 0x0000002c jle 00007FD448BF5539h 0x0000002e add esp, 04h 0x00000031 jnbe 00007FD448BF55BBh 0x00000033 pushfd 0x00000034 mov cx, word ptr [esp+02h] 0x00000039 jmp 00007FD448BF5574h 0x0000003b lea edi, dword ptr [ecx+ebx] 0x0000003e mov edi, dword ptr [esp+04h] 0x00000042 mov edx, 6C4C3A78h 0x00000047 push dx 0x00000049 jmp 00007FD448BF55A0h 0x0000004b lea esp, dword ptr [esp+02h] 0x0000004f lea esp, dword ptr [esp+08h] 0x00000053 call 00007FD448BF55C1h 0x00000058 mov ax, dx 0x0000005b mov cl, B9h 0x0000005d bt dx, bx 0x00000061 xchg dword ptr [esp], ecx 0x00000064 jmp 00007FD448BF556Eh 0x00000066 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B903 second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 sub edx, eax 0x00000004 mov ax, bx 0x00000007 add dx, dx 0x0000000a mov ah, E4h 0x0000000c jmp 00007FD448BFA108h 0x0000000e lea ecx, dword ptr [ecx-0000ED1Ch] 0x00000014 mov dx, AE09h 0x00000018 mov eax, dword ptr [esp] 0x0000001b btc ax, si 0x0000001f call 00007FD448BFA3ADh 0x00000024 xchg dword ptr [esp+04h], ecx 0x00000028 mov ch, byte ptr [esp] 0x0000002b jmp 00007FD448BF9F23h 0x00000030 sub esp, 16h 0x00000033 mov ax, word ptr [esp+07h] 0x00000038 mov ecx, dword ptr [esp+12h] 0x0000003c add esp, 07h 0x0000003f lea esp, dword ptr [esp+03h] 0x00000043 push dword ptr [esp+10h] 0x00000047 retn 0014h 0x0000004a mov ebx, ebp 0x0000004c lea eax, dword ptr [esp+ecx] 0x0000004f setle ah 0x00000052 sets dl 0x00000055 call 00007FD448BFA0CFh 0x0000005a xchg cl, ch 0x0000005c pushad 0x0000005d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CBBE second address: 000000006C83CBE2 instructions: 0x00000000 rdtsc 0x00000002 mov al, bh 0x00000004 xchg dword ptr [esp+20h], esi 0x00000008 jmp 00007FD448BF55ACh 0x0000000a rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CBE2 second address: 000000006C83CCAF instructions: 0x00000000 rdtsc 0x00000002 xchg ecx, edx 0x00000004 mov ax, word ptr [esp] 0x00000008 mov edx, B68AAC39h 0x0000000d lea esi, dword ptr [esi-00000052h] 0x00000013 xchg eax, edx 0x00000014 jmp 00007FD448BFA113h 0x00000016 mov edx, ecx 0x00000018 lea eax, dword ptr [00000000h+edi*4] 0x0000001f mov dx, 208Bh 0x00000023 xchg dword ptr [esp+20h], esi 0x00000027 mov cl, ch 0x00000029 xchg dx, ax 0x0000002c jmp 00007FD448BFA0C3h 0x0000002e xchg dx, ax 0x00000031 mov ecx, dword ptr [esp] 0x00000034 push dword ptr [esp+20h] 0x00000038 retn 0024h 0x0000003b mov eax, 12F33EA2h 0x00000040 xor cl, 00000044h 0x00000043 jnl 00007FD448BFA1D0h 0x00000049 jl 00007FD448BFA1ACh 0x0000004f pushfd 0x00000050 mov dx, cx 0x00000053 mov dh, 56h 0x00000055 jmp 00007FD448BFA161h 0x00000057 lea eax, dword ptr [ebx-03h] 0x0000005a lea ecx, dword ptr [ecx-0F5291AAh] 0x00000060 jmp 00007FD448BFA09Dh 0x00000062 lea esp, dword ptr [esp+04h] 0x00000066 sub ebp, 1284C013h 0x0000006c call 00007FD448BFA10Ch 0x00000071 mov ecx, dword ptr [esp] 0x00000074 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CCAF second address: 000000006C83CC9D instructions: 0x00000000 rdtsc 0x00000002 neg al 0x00000004 neg al 0x00000006 push sp 0x00000008 jmp 00007FD448BF556Fh 0x0000000a lea esp, dword ptr [esp+02h] 0x0000000e xchg dword ptr [esp], ebx 0x00000011 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CC9D second address: 000000006C83CCC5 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 93656786h 0x00000007 jmp 00007FD448BFA105h 0x00000009 mov edx, dword ptr [esp] 0x0000000c lea ebx, dword ptr [ebx-00000034h] 0x00000012 shr eax, 0Ch 0x00000015 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CE39 second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF554Fh 0x00000004 xor ebp, 2D4823BBh 0x0000000a mov ah, byte ptr [esp] 0x0000000d clc 0x0000000e je 00007FD448BF5570h 0x00000010 jne 00007FD448BF559Ah 0x00000012 mov eax, 09013DC9h 0x00000017 sub esp, 19h 0x0000001a lea esp, dword ptr [esp+01h] 0x0000001e jmp 00007FD448BF5616h 0x00000023 add ebp, dword ptr [esi] 0x00000025 lea eax, dword ptr [00000000h+edx*4] 0x0000002c xchg ch, cl 0x0000002e jmp 00007FD448BF553Dh 0x00000030 movzx ecx, byte ptr [ebp+00h] 0x00000034 jmp 00007FD448BF556Fh 0x00000036 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CE3D second address: 000000006C83CEB5 instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 jnbe 00007FD448BFA126h 0x00000005 not ax 0x00000008 call 00007FD448BFA0D7h 0x0000000d mov ax, di 0x00000010 jmp 00007FD448BFA10Bh 0x00000012 mov edx, dword ptr [esp] 0x00000015 add esp, 02h 0x00000018 jmp 00007FD448BFA14Dh 0x0000001a jnle 00007FD448BFA099h 0x0000001c mov dl, dh 0x0000001e mov dh, byte ptr [esp+01h] 0x00000022 call 00007FD448BFA129h 0x00000027 lea esp, dword ptr [esp+02h] 0x0000002b jmp 00007FD448BFA0D6h 0x0000002d add cl, bl 0x0000002f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83D042 second address: 000000006C83D0C7 instructions: 0x00000000 rdtsc 0x00000002 btr eax, ebp 0x00000005 jnp 00007FD448BF55D9h 0x00000007 mov dx, word ptr [esp] 0x0000000b jmp 00007FD448BF55C2h 0x0000000d inc ebp 0x0000000e rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83DC6E second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 and cx, si 0x00000005 jnc 00007FD448BFA11Eh 0x00000007 jmp 00007FD448BFA0DAh 0x00000009 mov dx, word ptr [esp] 0x0000000d jmp 00007FD448BFA118h 0x0000000f sub esp, 02h 0x00000012 jne 00007FD448BFA131h 0x00000014 lea eax, dword ptr [esp+edi] 0x00000017 lea esp, dword ptr [esp+02h] 0x0000001b jmp 00007FD448BFA124h 0x0000001d lea eax, dword ptr [edi+50h] 0x00000020 xchg dx, cx 0x00000023 stc 0x00000024 jc 00007FD448BFA078h 0x00000026 push di 0x00000028 lea esp, dword ptr [esp+02h] 0x0000002c jmp 00007FD448BFA166h 0x0000002e cmp esi, eax 0x00000030 jmp 00007FD448BFA22Bh 0x00000035 jl 00007FD448BF9FBBh 0x0000003b jnl 00007FD448BF9FB5h 0x00000041 ja 00007FD448BF9201h 0x00000047 movzx ecx, byte ptr [ebp+00h] 0x0000004b jmp 00007FD448BFA0CFh 0x0000004d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84DBDC second address: 000000006C84DDC5 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 stc 0x00000004 jnc 00007FD448BF5552h 0x00000006 shl bp, cl 0x00000009 jmp 00007FD448BF5631h 0x0000000e push esi 0x0000000f xchg bp, ax 0x00000012 pushfd 0x00000013 jmp 00007FD448BF5547h 0x00000015 inc bp 0x00000017 jnc 00007FD448BF556Ah 0x00000019 jc 00007FD448BF5568h 0x0000001b push edi 0x0000001c xchg dh, dl 0x0000001e xchg dl, cl 0x00000020 jmp 00007FD448BF5575h 0x00000022 sub esp, 00000000h 0x00000025 jbe 00007FD448BF55AAh 0x00000027 mov ecx, dword ptr [esp] 0x0000002a lea edx, dword ptr [esi+esi] 0x0000002d add dx, bx 0x00000030 jmp 00007FD448BF55DBh 0x00000032 pop ebp 0x00000033 sub esp, 03h 0x00000036 jbe 00007FD448BF5573h 0x00000038 rol esi, cl 0x0000003a add esp, 01h 0x0000003d lea esp, dword ptr [esp+02h] 0x00000041 jmp 00007FD448BF5759h 0x00000046 add esp, 04h 0x00000049 jno 00007FD448BF5518h 0x0000004b pop edi 0x0000004c rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C848B7C second address: 000000006C848BB9 instructions: 0x00000000 rdtsc 0x00000002 lea ecx, dword ptr [00000000h+esi*4] 0x00000009 neg cx 0x0000000c jmp 00007FD448BFA11Eh 0x0000000e lea eax, dword ptr [eax+ecx] 0x00000011 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C848BB9 second address: 000000006C848B0F instructions: 0x00000000 rdtsc 0x00000002 push dword ptr [esp+04h] 0x00000006 retn 0008h 0x00000009 sub ebp, 04h 0x0000000c rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C848B0F second address: 000000006C848C6A instructions: 0x00000000 rdtsc 0x00000002 xchg dh, ch 0x00000004 jmp 00007FD448BFA28Dh 0x00000009 not eax 0x0000000b not ax 0x0000000e mov edx, edi 0x00000010 mov ecx, dword ptr [edx] 0x00000012 jmp 00007FD448BFA09Fh 0x00000014 mov eax, edx 0x00000016 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C848C6A second address: 000000006C848C3A instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 jne 00007FD448BF555Dh 0x00000005 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C849089 second address: 000000006C84907A instructions: 0x00000000 rdtsc 0x00000002 pop eax 0x00000003 lea esi, dword ptr [esi-00000153h] 0x00000009 mov dh, BBh 0x0000000b mov dh, byte ptr [esp] 0x0000000e jmp 00007FD448BFA0BFh 0x00000010 mov eax, 75B25F11h 0x00000015 lea edx, dword ptr [00000000h+eax*4] 0x0000001c xchg dword ptr [esp+10h], esi 0x00000020 push edi 0x00000021 mov byte ptr [esp], al 0x00000024 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C8534FB second address: 000000006C85353D instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 call 00007FD448BF5573h 0x00000008 push esp 0x00000009 mov esi, dword ptr [esp+03h] 0x0000000d bswap eax 0x0000000f mov byte ptr [esp+01h], cl 0x00000013 mov word ptr [esp+01h], sp 0x00000018 jmp 00007FD448BF55B9h 0x0000001a xchg dword ptr [esp+04h], ebp 0x0000001e pushad 0x0000001f inc cx 0x00000021 bsf di, bx 0x00000025 pop esi 0x00000026 clc 0x00000027 jmp 00007FD448BF556Dh 0x00000029 lea ebp, dword ptr [ebp-0000003Ch] 0x0000002f mov cl, dl 0x00000031 bsr edi, ecx 0x00000034 cmc 0x00000035 cmc 0x00000036 jmp 00007FD448BF55DDh 0x00000038 xchg dword ptr [esp+20h], ebp 0x0000003c inc cl 0x0000003e cmc 0x0000003f setne dh 0x00000042 lea edi, dword ptr [ecx+ebp] 0x00000045 push dword ptr [esp+20h] 0x00000049 retn 0024h 0x0000004c bswap edx 0x0000004e jmp 00007FD448BF5604h 0x00000050 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C85353D second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 lea edx, dword ptr [ecx+000000CFh] 0x00000008 mov cl, ch 0x0000000a mov al, 0Ch 0x0000000c mov esi, eax 0x0000000e sub esp, 0Bh 0x00000011 jmp 00007FD448BFA114h 0x00000013 jle 00007FD448BFA110h 0x00000015 mov al, ah 0x00000017 lea esp, dword ptr [esp+03h] 0x0000001b jmp 00007FD448BFA10Eh 0x0000001d jmp 00007FD448BFA0D4h 0x0000001f add esp, 08h 0x00000022 jo 00007FD448BFA121h 0x00000024 jno 00007FD448BFA11Fh 0x00000026 pop esi 0x00000027 xchg ch, al 0x00000029 pushfd 0x0000002a jmp 00007FD448BFA0D6h 0x0000002c mov cl, 90h 0x0000002e bswap edx 0x00000030 jmp 00007FD448BFA108h 0x00000032 add esp, 04h 0x00000035 jmp 00007FD448BFA20Eh 0x0000003a jne 00007FD448BF9FD8h 0x00000040 pop ebp 0x00000041 mov di, word ptr [esp] 0x00000045 xchg ah, al 0x00000047 mov ah, 7Dh 0x00000049 jmp 00007FD448BFA1ACh 0x0000004e bsr ax, bp 0x00000052 jnbe 00007FD448BFA07Ch 0x00000054 pop edi 0x00000055 jmp 00007FD448BE36ACh 0x0000005a mov ebx, ebp 0x0000005c lea eax, dword ptr [esp+ecx] 0x0000005f setle ah 0x00000062 sets dl 0x00000065 call 00007FD448BFA0CFh 0x0000006a xchg cl, ch 0x0000006c pushad 0x0000006d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84BA9C second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 mov eax, dword ptr [esp] 0x00000005 jmp 00007FD448BE6949h 0x0000000a movzx ecx, byte ptr [ebp+00h] 0x0000000e jmp 00007FD448BF556Fh 0x00000010 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C851465 second address: 000000006C85146C instructions: 0x00000000 rdtsc 0x00000002 not ah 0x00000004 ror cl, 00000000h 0x00000007 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C853196 second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 stc 0x00000003 jmp 00007FD448BF56B8h 0x00000008 jo 00007FD448BF546Eh 0x0000000e mov edx, 4C97B051h 0x00000013 neg edx 0x00000015 jmp 00007FD448BF5513h 0x00000017 mov eax, dword ptr [esi] 0x0000001a setnl dh 0x0000001d jmp 00007FD448BF55ACh 0x0000001f mov dh, cl 0x00000021 call 00007FD448BF5574h 0x00000026 sub esi, 04h 0x00000029 mov edx, esi 0x0000002b lea edx, dword ptr [esp+esi] 0x0000002e pushfd 0x0000002f jmp 00007FD448BF55BEh 0x00000031 btc ecx, ecx 0x00000034 jle 00007FD448BF5577h 0x00000036 jnle 00007FD448BF5575h 0x00000038 mov dword ptr [esi], eax 0x0000003a lea ecx, dword ptr [ebp+00003F07h] 0x00000040 bts cx, bx 0x00000044 jmp 00007FD448BF5619h 0x00000049 jc 00007FD448BF5518h 0x0000004b xchg dh, cl 0x0000004d mov dx, FA48h 0x00000051 jmp 00007FD448BF3B3Ch 0x00000056 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C851BCB second address: 000000006C851E93 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 11h 0x00000005 mov word ptr [esp+07h], ax 0x0000000a inc dx 0x0000000c jmp 00007FD448BFA10Dh 0x0000000e lea esp, dword ptr [esp+01h] 0x00000012 lea edi, dword ptr [edi-0000002Bh] 0x00000018 bswap edx 0x0000001a adc edx, ecx 0x0000001c dec dh 0x0000001e setb ah 0x00000021 jmp 00007FD448BFA73Fh 0x00000026 xchg dword ptr [esp+10h], edi 0x0000002a bsr eax, ecx 0x0000002d sub eax, esi 0x0000002f push dword ptr [esp+10h] 0x00000033 retn 0014h 0x00000036 mov edx, eax 0x00000038 mov eax, ebp 0x0000003a btr eax, ebp 0x0000003d jmp 00007FD448BFA500h 0x00000042 jl 00007FD448BFA28Ah 0x00000048 mov eax, esi 0x0000004a inc cl 0x0000004c bsr dx, ax 0x00000050 jmp 00007FD448BF9D49h 0x00000055 jnp 00007FD448BFA1CEh 0x0000005b mov edx, dword ptr [esp] 0x0000005e xchg eax, edx 0x0000005f jmp 00007FD448BF9FD1h 0x00000064 bsf edx, ebp 0x00000067 jmp 00007FD448BFA2E7h 0x0000006c pushad 0x0000006d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C85345B second address: 000000006C8534FB instructions: 0x00000000 rdtsc 0x00000002 mov ch, bh 0x00000004 stc 0x00000005 mov eax, dword ptr [esp] 0x00000008 jmp 00007FD448BF55A9h 0x0000000a mov dl, E0h 0x0000000c push dword ptr [esp+18h] 0x00000010 retn 001Ch 0x00000013 mov edi, dword ptr [ebp+00h] 0x00000016 lea eax, dword ptr [edx+ebx] 0x00000019 setnle cl 0x0000001c mov eax, B0A52D3Ah 0x00000021 jmp 00007FD448BF5779h 0x00000026 push bx 0x00000028 lea esp, dword ptr [esp+02h] 0x0000002c add ebp, 04h 0x0000002f mov dx, word ptr [esp] 0x00000033 mov ecx, edx 0x00000035 jmp 00007FD448BF54D5h 0x0000003a push esi 0x0000003b neg ah 0x0000003d jnle 00007FD448BF5537h 0x0000003f not ch 0x00000041 cmc 0x00000042 jmp 00007FD448BF5512h 0x00000044 push edi 0x00000045 neg ecx 0x00000047 jne 00007FD448BF5576h 0x00000049 jmp 00007FD448BF55E4h 0x0000004b clc 0x0000004c rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C85345B second address: 000000006C8534FB instructions: 0x00000000 rdtsc 0x00000002 mov ch, bh 0x00000004 stc 0x00000005 mov eax, dword ptr [esp] 0x00000008 jmp 00007FD448BFA109h 0x0000000a mov dl, E0h 0x0000000c push dword ptr [esp+18h] 0x00000010 retn 001Ch 0x00000013 mov edi, dword ptr [ebp+00h] 0x00000016 lea eax, dword ptr [edx+ebx] 0x00000019 setnle cl 0x0000001c mov eax, B0A52D3Ah 0x00000021 jmp 00007FD448BFA2D9h 0x00000026 push bx 0x00000028 lea esp, dword ptr [esp+02h] 0x0000002c add ebp, 04h 0x0000002f mov dx, word ptr [esp] 0x00000033 mov ecx, edx 0x00000035 jmp 00007FD448BFA035h 0x0000003a push esi 0x0000003b neg ah 0x0000003d jnle 00007FD448BFA097h 0x0000003f not ch 0x00000041 cmc 0x00000042 jmp 00007FD448BFA072h 0x00000044 push edi 0x00000045 neg ecx 0x00000047 jne 00007FD448BFA0D6h 0x00000049 jmp 00007FD448BFA144h 0x0000004b clc 0x0000004c rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84AD3A second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [00000000h+ebx*4] 0x00000009 mov ecx, D5B43DB6h 0x0000000e jmp 00007FD448BE7419h 0x00000013 mov ebx, ebp 0x00000015 lea eax, dword ptr [esp+ecx] 0x00000018 setle ah 0x0000001b sets dl 0x0000001e call 00007FD448BF556Fh 0x00000023 xchg cl, ch 0x00000025 pushad 0x00000026 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84AD3A second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [00000000h+ebx*4] 0x00000009 mov ecx, D5B43DB6h 0x0000000e jmp 00007FD448BEBF79h 0x00000013 mov ebx, ebp 0x00000015 lea eax, dword ptr [esp+ecx] 0x00000018 setle ah 0x0000001b sets dl 0x0000001e call 00007FD448BFA0CFh 0x00000023 xchg cl, ch 0x00000025 pushad 0x00000026 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C85457D second address: 000000006C85457F instructions: 0x00000000 rdtsc 0x00000002 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84E1D1 second address: 000000006C84E3D9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 xchg word ptr [esp], ax 0x00000007 lea ecx, dword ptr [ecx+esi] 0x0000000a xchg dword ptr [esp+04h], esi 0x0000000e jmp 00007FD448BF5596h 0x00000010 cmc 0x00000011 neg al 0x00000013 dec cx 0x00000015 lea ecx, dword ptr [00000000h+edi*4] 0x0000001c mov eax, 63E4BEA4h 0x00000021 jmp 00007FD448BF5770h 0x00000026 lea esi, dword ptr [esi+2Ah] 0x00000029 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C8621EC second address: 000000006C8621EE instructions: 0x00000000 rdtsc 0x00000002 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83EAC9 second address: 000000006C83EEF8 instructions: 0x00000000 rdtsc 0x00000002 mov dl, F2h 0x00000004 bswap ecx 0x00000006 call 00007FD448BFA0CAh 0x0000000b jmp 00007FD448BFA11Bh 0x0000000d lea ebx, dword ptr [ebx+55h] 0x00000010 lea ecx, dword ptr [00000000h+ebx*4] 0x00000017 bsr bp, cx 0x0000001b rcl ecx, 19h 0x0000001e xchg dword ptr [esp+04h], ebx 0x00000022 jmp 00007FD448BFA54Bh 0x00000027 mov al, F1h 0x00000029 rcl bx, 1 0x0000002c inc bx 0x0000002e sub esp, 1Eh 0x00000031 ror ax, 0002h 0x00000035 lea esp, dword ptr [esp+02h] 0x00000039 jmp 00007FD448BFA0B0h 0x0000003b push dword ptr [esp+20h] 0x0000003f retn 0024h 0x00000042 lea edi, dword ptr [esp+0Ch] 0x00000046 mov dl, byte ptr [esp] 0x00000049 jmp 00007FD448BFA55Ah 0x0000004e sub esp, 000000B4h 0x00000054 mov ebp, esp 0x00000056 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B709 second address: 000000006C84B85B instructions: 0x00000000 rdtsc 0x00000002 mov ah, byte ptr [esp] 0x00000005 jmp 00007FD448BF55ADh 0x00000007 mov dh, byte ptr [esp] 0x0000000a jmp 00007FD448BF55C0h 0x0000000c mov ecx, edi 0x0000000e mov esi, dword ptr [ecx] 0x00000010 bsf ecx, ecx 0x00000013 jnp 00007FD448BF5573h 0x00000015 jmp 00007FD448BF5625h 0x0000001a mov al, 96h 0x0000001c xchg edx, ecx 0x0000001e add edi, 04h 0x00000021 jmp 00007FD448BF5549h 0x00000023 btc edx, esi 0x00000026 je 00007FD448BF5577h 0x00000028 bsr eax, edi 0x0000002b setnl dh 0x0000002e jmp 00007FD448BF55ACh 0x00000030 push ebp 0x00000031 lea ecx, dword ptr [ecx+esi] 0x00000034 call 00007FD448BF5572h 0x00000039 mov ch, byte ptr [esp] 0x0000003c push esi 0x0000003d jmp 00007FD448BF5612h 0x00000042 and ebp, esi 0x00000044 jns 00007FD448BF555Eh 0x00000046 mov cx, word ptr [esp] 0x0000004a mov cl, byte ptr [esp] 0x0000004d jmp 00007FD448BF556Fh 0x0000004f dec ax 0x00000051 push edi 0x00000052 mov dx, 9280h 0x00000056 mov dx, B8F4h 0x0000005a jmp 00007FD448BF55A8h 0x0000005c mov bp, word ptr [esp] 0x00000060 sbb ax, bp 0x00000063 jmp 00007FD448BF55D9h 0x00000065 jnc 00007FD448BF554Dh 0x00000067 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B85B second address: 000000006C84B903 instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [eax+ebx] 0x00000005 jmp 00007FD448BFA0CFh 0x00000007 cmp eax, 9DA45E12h 0x0000000c push si 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 jmp 00007FD448BFA11Eh 0x00000014 pop esi 0x00000015 mov al, dl 0x00000017 mov al, dl 0x00000019 clc 0x0000001a jnp 00007FD448BFA0D4h 0x0000001c jp 00007FD448BFA166h 0x0000001e pop ebp 0x0000001f mov ch, 2Fh 0x00000021 mov ax, BE00h 0x00000025 or eax, ebx 0x00000027 jnle 00007FD448BFA0B1h 0x00000029 jle 00007FD448BFA099h 0x0000002b add esp, 04h 0x0000002e jnbe 00007FD448BFA11Bh 0x00000030 pushfd 0x00000031 mov cx, word ptr [esp+02h] 0x00000036 jmp 00007FD448BFA0D4h 0x00000038 lea edi, dword ptr [ecx+ebx] 0x0000003b mov edi, dword ptr [esp+04h] 0x0000003f mov edx, 6C4C3A78h 0x00000044 push dx 0x00000046 jmp 00007FD448BFA100h 0x00000048 lea esp, dword ptr [esp+02h] 0x0000004c lea esp, dword ptr [esp+08h] 0x00000050 call 00007FD448BFA121h 0x00000055 mov ax, dx 0x00000058 mov cl, B9h 0x0000005a bt dx, bx 0x0000005e xchg dword ptr [esp], ecx 0x00000061 jmp 00007FD448BFA0CEh 0x00000063 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B903 second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 sub edx, eax 0x00000004 mov ax, bx 0x00000007 add dx, dx 0x0000000a mov ah, E4h 0x0000000c jmp 00007FD448BF55A8h 0x0000000e lea ecx, dword ptr [ecx-0000ED1Ch] 0x00000014 mov dx, AE09h 0x00000018 mov eax, dword ptr [esp] 0x0000001b btc ax, si 0x0000001f call 00007FD448BF584Dh 0x00000024 xchg dword ptr [esp+04h], ecx 0x00000028 mov ch, byte ptr [esp] 0x0000002b jmp 00007FD448BF53C3h 0x00000030 sub esp, 16h 0x00000033 mov ax, word ptr [esp+07h] 0x00000038 mov ecx, dword ptr [esp+12h] 0x0000003c add esp, 07h 0x0000003f lea esp, dword ptr [esp+03h] 0x00000043 push dword ptr [esp+10h] 0x00000047 retn 0014h 0x0000004a mov ebx, ebp 0x0000004c lea eax, dword ptr [esp+ecx] 0x0000004f setle ah 0x00000052 sets dl 0x00000055 call 00007FD448BF556Fh 0x0000005a xchg cl, ch 0x0000005c pushad 0x0000005d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CBBE second address: 000000006C83CBE2 instructions: 0x00000000 rdtsc 0x00000002 mov al, bh 0x00000004 xchg dword ptr [esp+20h], esi 0x00000008 jmp 00007FD448BFA10Ch 0x0000000a rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CBE2 second address: 000000006C83CCAF instructions: 0x00000000 rdtsc 0x00000002 xchg ecx, edx 0x00000004 mov ax, word ptr [esp] 0x00000008 mov edx, B68AAC39h 0x0000000d lea esi, dword ptr [esi-00000052h] 0x00000013 xchg eax, edx 0x00000014 jmp 00007FD448BF55B3h 0x00000016 mov edx, ecx 0x00000018 lea eax, dword ptr [00000000h+edi*4] 0x0000001f mov dx, 208Bh 0x00000023 xchg dword ptr [esp+20h], esi 0x00000027 mov cl, ch 0x00000029 xchg dx, ax 0x0000002c jmp 00007FD448BF5563h 0x0000002e xchg dx, ax 0x00000031 mov ecx, dword ptr [esp] 0x00000034 push dword ptr [esp+20h] 0x00000038 retn 0024h 0x0000003b mov eax, 12F33EA2h 0x00000040 xor cl, 00000044h 0x00000043 jnl 00007FD448BF5670h 0x00000049 pushfd 0x0000004a mov dx, cx 0x0000004d mov dh, 56h 0x0000004f lea eax, dword ptr [ebx-03h] 0x00000052 lea ecx, dword ptr [ecx-0F5291AAh] 0x00000058 lea esp, dword ptr [esp+04h] 0x0000005c sub ebp, 1284C013h 0x00000062 call 00007FD448BF55ACh 0x00000067 mov ecx, dword ptr [esp] 0x0000006a rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CCAF second address: 000000006C83CC9D instructions: 0x00000000 rdtsc 0x00000002 neg al 0x00000004 neg al 0x00000006 push sp 0x00000008 jmp 00007FD448BFA0CFh 0x0000000a lea esp, dword ptr [esp+02h] 0x0000000e xchg dword ptr [esp], ebx 0x00000011 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CC9D second address: 000000006C83CCC5 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 93656786h 0x00000007 jmp 00007FD448BF55A5h 0x00000009 mov edx, dword ptr [esp] 0x0000000c lea ebx, dword ptr [ebx-00000034h] 0x00000012 shr eax, 0Ch 0x00000015 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CE39 second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFA0AFh 0x00000004 xor ebp, 2D4823BBh 0x0000000a mov ah, byte ptr [esp] 0x0000000d clc 0x0000000e je 00007FD448BFA0D0h 0x00000010 jne 00007FD448BFA0FAh 0x00000012 mov eax, 09013DC9h 0x00000017 sub esp, 19h 0x0000001a lea esp, dword ptr [esp+01h] 0x0000001e jmp 00007FD448BFA176h 0x00000023 add ebp, dword ptr [esi] 0x00000025 lea eax, dword ptr [00000000h+edx*4] 0x0000002c xchg ch, cl 0x0000002e jmp 00007FD448BFA09Dh 0x00000030 movzx ecx, byte ptr [ebp+00h] 0x00000034 jmp 00007FD448BFA0CFh 0x00000036 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CE3D second address: 000000006C83CEB5 instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 jnbe 00007FD448BF55C6h 0x00000005 not ax 0x00000008 call 00007FD448BF5577h 0x0000000d mov ax, di 0x00000010 jmp 00007FD448BF55ABh 0x00000012 mov edx, dword ptr [esp] 0x00000015 add esp, 02h 0x00000018 jmp 00007FD448BF55EDh 0x0000001a jnle 00007FD448BF5539h 0x0000001c mov dl, dh 0x0000001e mov dh, byte ptr [esp+01h] 0x00000022 call 00007FD448BF55C9h 0x00000027 lea esp, dword ptr [esp+02h] 0x0000002b jmp 00007FD448BF5576h 0x0000002d add cl, bl 0x0000002f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83D042 second address: 000000006C83D0C7 instructions: 0x00000000 rdtsc 0x00000002 btr eax, ebp 0x00000005 jnp 00007FD448BFA139h 0x00000007 mov dx, word ptr [esp] 0x0000000b jmp 00007FD448BFA122h 0x0000000d inc ebp 0x0000000e rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83DC6E second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 and cx, si 0x00000005 jnc 00007FD448BF55BEh 0x00000007 jmp 00007FD448BF557Ah 0x00000009 mov dx, word ptr [esp] 0x0000000d jmp 00007FD448BF55B8h 0x0000000f sub esp, 02h 0x00000012 jne 00007FD448BF55D1h 0x00000014 lea eax, dword ptr [esp+edi] 0x00000017 lea esp, dword ptr [esp+02h] 0x0000001b jmp 00007FD448BF55C4h 0x0000001d lea eax, dword ptr [edi+50h] 0x00000020 xchg dx, cx 0x00000023 stc 0x00000024 jc 00007FD448BF5518h 0x00000026 push di 0x00000028 lea esp, dword ptr [esp+02h] 0x0000002c jmp 00007FD448BF5606h 0x0000002e cmp esi, eax 0x00000030 jmp 00007FD448BF56CBh 0x00000035 jl 00007FD448BF545Bh 0x0000003b jnl 00007FD448BF5455h 0x00000041 ja 00007FD448BF46A1h 0x00000047 movzx ecx, byte ptr [ebp+00h] 0x0000004b jmp 00007FD448BF556Fh 0x0000004d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84DBDC second address: 000000006C84DDC5 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 stc 0x00000004 jnc 00007FD448BFA0B2h 0x00000006 shl bp, cl 0x00000009 jmp 00007FD448BFA191h 0x0000000e push esi 0x0000000f xchg bp, ax 0x00000012 pushfd 0x00000013 jmp 00007FD448BFA0A7h 0x00000015 inc bp 0x00000017 jnc 00007FD448BFA0CAh 0x00000019 jc 00007FD448BFA0C8h 0x0000001b push edi 0x0000001c xchg dh, dl 0x0000001e xchg dl, cl 0x00000020 jmp 00007FD448BFA0D5h 0x00000022 sub esp, 00000000h 0x00000025 jbe 00007FD448BFA10Ah 0x00000027 mov ecx, dword ptr [esp] 0x0000002a lea edx, dword ptr [esi+esi] 0x0000002d add dx, bx 0x00000030 jmp 00007FD448BFA13Bh 0x00000032 pop ebp 0x00000033 sub esp, 03h 0x00000036 jbe 00007FD448BFA0D3h 0x00000038 rol esi, cl 0x0000003a add esp, 01h 0x0000003d lea esp, dword ptr [esp+02h] 0x00000041 jmp 00007FD448BFA2B9h 0x00000046 add esp, 04h 0x00000049 jno 00007FD448BFA078h 0x0000004b pop edi 0x0000004c rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C848B7C second address: 000000006C848BB9 instructions: 0x00000000 rdtsc 0x00000002 lea ecx, dword ptr [00000000h+esi*4] 0x00000009 neg cx 0x0000000c jmp 00007FD448BF55BEh 0x0000000e lea eax, dword ptr [eax+ecx] 0x00000011 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C848B0F second address: 000000006C848C6A instructions: 0x00000000 rdtsc 0x00000002 xchg dh, ch 0x00000004 jmp 00007FD448BF572Dh 0x00000009 not eax 0x0000000b not ax 0x0000000e mov edx, edi 0x00000010 mov ecx, dword ptr [edx] 0x00000012 jmp 00007FD448BF553Fh 0x00000014 mov eax, edx 0x00000016 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C848C6A second address: 000000006C848C3A instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 jne 00007FD448BFA0BDh 0x00000005 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C849089 second address: 000000006C84907A instructions: 0x00000000 rdtsc 0x00000002 pop eax 0x00000003 lea esi, dword ptr [esi-00000153h] 0x00000009 mov dh, BBh 0x0000000b mov dh, byte ptr [esp] 0x0000000e jmp 00007FD448BF555Fh 0x00000010 mov eax, 75B25F11h 0x00000015 lea edx, dword ptr [00000000h+eax*4] 0x0000001c xchg dword ptr [esp+10h], esi 0x00000020 push edi 0x00000021 mov byte ptr [esp], al 0x00000024 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C8534FB second address: 000000006C85353D instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 call 00007FD448BFA0D3h 0x00000008 push esp 0x00000009 mov esi, dword ptr [esp+03h] 0x0000000d bswap eax 0x0000000f mov byte ptr [esp+01h], cl 0x00000013 mov word ptr [esp+01h], sp 0x00000018 jmp 00007FD448BFA119h 0x0000001a xchg dword ptr [esp+04h], ebp 0x0000001e pushad 0x0000001f inc cx 0x00000021 bsf di, bx 0x00000025 pop esi 0x00000026 clc 0x00000027 jmp 00007FD448BFA0CDh 0x00000029 lea ebp, dword ptr [ebp-0000003Ch] 0x0000002f mov cl, dl 0x00000031 bsr edi, ecx 0x00000034 cmc 0x00000035 cmc 0x00000036 jmp 00007FD448BFA13Dh 0x00000038 xchg dword ptr [esp+20h], ebp 0x0000003c inc cl 0x0000003e cmc 0x0000003f setne dh 0x00000042 lea edi, dword ptr [ecx+ebp] 0x00000045 push dword ptr [esp+20h] 0x00000049 retn 0024h 0x0000004c bswap edx 0x0000004e jmp 00007FD448BFA164h 0x00000050 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C85353D second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 lea edx, dword ptr [ecx+000000CFh] 0x00000008 mov cl, ch 0x0000000a mov al, 0Ch 0x0000000c mov esi, eax 0x0000000e sub esp, 0Bh 0x00000011 jmp 00007FD448BF55B4h 0x00000013 jle 00007FD448BF55B0h 0x00000015 mov al, ah 0x00000017 lea esp, dword ptr [esp+03h] 0x0000001b jmp 00007FD448BF55AEh 0x0000001d jmp 00007FD448BF5574h 0x0000001f add esp, 08h 0x00000022 jo 00007FD448BF55C1h 0x00000024 jno 00007FD448BF55BFh 0x00000026 pop esi 0x00000027 xchg ch, al 0x00000029 pushfd 0x0000002a jmp 00007FD448BF5576h 0x0000002c mov cl, 90h 0x0000002e bswap edx 0x00000030 jmp 00007FD448BF55A8h 0x00000032 add esp, 04h 0x00000035 jmp 00007FD448BF56AEh 0x0000003a jne 00007FD448BF5478h 0x00000040 pop ebp 0x00000041 mov di, word ptr [esp] 0x00000045 xchg ah, al 0x00000047 mov ah, 7Dh 0x00000049 jmp 00007FD448BF564Ch 0x0000004e bsr ax, bp 0x00000052 jnbe 00007FD448BF551Ch 0x00000054 pop edi 0x00000055 jmp 00007FD448BDEB4Ch 0x0000005a mov ebx, ebp 0x0000005c lea eax, dword ptr [esp+ecx] 0x0000005f setle ah 0x00000062 sets dl 0x00000065 call 00007FD448BF556Fh 0x0000006a xchg cl, ch 0x0000006c pushad 0x0000006d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84BA9C second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 mov eax, dword ptr [esp] 0x00000005 jmp 00007FD448BEB4A9h 0x0000000a movzx ecx, byte ptr [ebp+00h] 0x0000000e jmp 00007FD448BFA0CFh 0x00000010 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C853196 second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 stc 0x00000003 jmp 00007FD448BFA218h 0x00000008 jo 00007FD448BF9FCEh 0x0000000e mov edx, 4C97B051h 0x00000013 neg edx 0x00000015 jmp 00007FD448BFA073h 0x00000017 mov eax, dword ptr [esi] 0x0000001a setnl dh 0x0000001d jmp 00007FD448BFA10Ch 0x0000001f mov dh, cl 0x00000021 call 00007FD448BFA0D4h 0x00000026 sub esi, 04h 0x00000029 mov edx, esi 0x0000002b lea edx, dword ptr [esp+esi] 0x0000002e pushfd 0x0000002f jmp 00007FD448BFA11Eh 0x00000031 btc ecx, ecx 0x00000034 jle 00007FD448BFA0D7h 0x00000036 jnle 00007FD448BFA0D5h 0x00000038 mov dword ptr [esi], eax 0x0000003a lea ecx, dword ptr [ebp+00003F07h] 0x00000040 bts cx, bx 0x00000044 jmp 00007FD448BFA179h 0x00000049 jc 00007FD448BFA078h 0x0000004b xchg dh, cl 0x0000004d mov dx, FA48h 0x00000051 jmp 00007FD448BF869Ch 0x00000056 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C851BCB second address: 000000006C851E93 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 11h 0x00000005 mov word ptr [esp+07h], ax 0x0000000a inc dx 0x0000000c jmp 00007FD448BF55ADh 0x0000000e lea esp, dword ptr [esp+01h] 0x00000012 lea edi, dword ptr [edi-0000002Bh] 0x00000018 bswap edx 0x0000001a adc edx, ecx 0x0000001c dec dh 0x0000001e setb ah 0x00000021 jmp 00007FD448BF5BDFh 0x00000026 xchg dword ptr [esp+10h], edi 0x0000002a bsr eax, ecx 0x0000002d sub eax, esi 0x0000002f push dword ptr [esp+10h] 0x00000033 retn 0014h 0x00000036 mov edx, eax 0x00000038 mov eax, ebp 0x0000003a btr eax, ebp 0x0000003d jmp 00007FD448BF59A0h 0x00000042 jl 00007FD448BF572Ah 0x00000048 mov eax, esi 0x0000004a inc cl 0x0000004c bsr dx, ax 0x00000050 jmp 00007FD448BF51E9h 0x00000055 jnp 00007FD448BF566Eh 0x0000005b mov edx, dword ptr [esp] 0x0000005e xchg eax, edx 0x0000005f jmp 00007FD448BF5471h 0x00000064 bsf edx, ebp 0x00000067 jmp 00007FD448BF5787h 0x0000006c pushad 0x0000006d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83A7C8 second address: 000000006C83A807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFA0CCh 0x00000004 sub esp, 000000A0h 0x0000000a call 00007FD448BFA145h 0x0000000f setno bl 0x00000012 mov al, byte ptr [esp] 0x00000015 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C8539C4 second address: 000000006C8539F9 instructions: 0x00000000 rdtsc 0x00000002 lea esp, dword ptr [esp+02h] 0x00000006 jmp 00007FD448BF5565h 0x00000008 lea ebp, dword ptr [ebp-00000520h] 0x0000000e xchg eax, edx 0x0000000f lea eax, dword ptr [00000000h+ecx*4] 0x00000016 jmp 00007FD448BF55CCh 0x00000018 mov dx, bp 0x0000001b lea eax, dword ptr [edi+ebp] 0x0000001e not eax 0x00000020 xchg dword ptr [esp+3Ch], ebp 0x00000024 bsf dx, di 0x00000028 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83A7C8 second address: 000000006C83A807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF556Ch 0x00000004 sub esp, 000000A0h 0x0000000a call 00007FD448BF55E5h 0x0000000f setno bl 0x00000012 mov al, byte ptr [esp] 0x00000015 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C8539C4 second address: 000000006C8539F9 instructions: 0x00000000 rdtsc 0x00000002 lea esp, dword ptr [esp+02h] 0x00000006 jmp 00007FD448BFA0C5h 0x00000008 lea ebp, dword ptr [ebp-00000520h] 0x0000000e xchg eax, edx 0x0000000f lea eax, dword ptr [00000000h+ecx*4] 0x00000016 jmp 00007FD448BFA12Ch 0x00000018 mov dx, bp 0x0000001b lea eax, dword ptr [edi+ebp] 0x0000001e not eax 0x00000020 xchg dword ptr [esp+3Ch], ebp 0x00000024 bsf dx, di 0x00000028 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A396 second address: 000000006C88A359 instructions: 0x00000000 rdtsc 0x00000002 bswap ecx 0x00000004 mov dh, byte ptr [esp] 0x00000007 jmp 00007FD448BF9FC8h 0x0000000c add esi, 02h 0x0000000f btr cx, ax 0x00000013 jno 00007FD448BFA1CDh 0x00000019 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A359 second address: 000000006C88A2DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF54E1h 0x00000007 not cl 0x00000009 call 00007FD448BF55DDh 0x0000000e lea edx, dword ptr [00000000h+esi*4] 0x00000015 mov cx, E8B9h 0x00000019 rcl dx, cl 0x0000001c btc cx, ax 0x00000020 xchg al, cl 0x00000022 jmp 00007FD448BF5559h 0x00000024 xchg dword ptr [esp], edi 0x00000027 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A2DB second address: 000000006C88A2D0 instructions: 0x00000000 rdtsc 0x00000002 btc eax, ebx 0x00000005 mov eax, edx 0x00000007 xchg ch, ah 0x00000009 lea edi, dword ptr [edi-0004D459h] 0x0000000f jmp 00007FD448BFA0C8h 0x00000011 mov eax, edi 0x00000013 mov dx, EA8Dh 0x00000017 lea ecx, dword ptr [ebx+52h] 0x0000001a xchg dword ptr [esp], edi 0x0000001d bswap edx 0x0000001f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A2D0 second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF55E5h 0x00000004 push dword ptr [esp] 0x00000007 retn 0004h 0x0000000a movzx ecx, byte ptr [ebp+00h] 0x0000000e jmp 00007FD448BF556Fh 0x00000010 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84E1D1 second address: 000000006C84E3D9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 xchg word ptr [esp], ax 0x00000007 lea ecx, dword ptr [ecx+esi] 0x0000000a xchg dword ptr [esp+04h], esi 0x0000000e jmp 00007FD448BFA0F6h 0x00000010 cmc 0x00000011 neg al 0x00000013 dec cx 0x00000015 lea ecx, dword ptr [00000000h+edi*4] 0x0000001c mov eax, 63E4BEA4h 0x00000021 jmp 00007FD448BFA2D0h 0x00000026 lea esi, dword ptr [esi+2Ah] 0x00000029 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B85B second address: 000000006C84B903 instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [eax+ebx] 0x00000005 jmp 00007FD448BFA0CFh 0x00000007 cmp eax, 9DA45E12h 0x0000000c push si 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 jmp 00007FD448BFA11Eh 0x00000014 pop esi 0x00000015 mov al, dl 0x00000017 mov al, dl 0x00000019 clc 0x0000001a jnp 00007FD448BFA0D4h 0x0000001c jmp 00007FD448BFA184h 0x00000021 pop ebp 0x00000022 mov ch, 2Fh 0x00000024 mov ax, BE00h 0x00000028 or eax, ebx 0x0000002a jnle 00007FD448BFA0B1h 0x0000002c jle 00007FD448BFA099h 0x0000002e add esp, 04h 0x00000031 jnbe 00007FD448BFA11Bh 0x00000033 pushfd 0x00000034 mov cx, word ptr [esp+02h] 0x00000039 jmp 00007FD448BFA0D4h 0x0000003b lea edi, dword ptr [ecx+ebx] 0x0000003e mov edi, dword ptr [esp+04h] 0x00000042 mov edx, 6C4C3A78h 0x00000047 push dx 0x00000049 jmp 00007FD448BFA100h 0x0000004b lea esp, dword ptr [esp+02h] 0x0000004f lea esp, dword ptr [esp+08h] 0x00000053 call 00007FD448BFA121h 0x00000058 mov ax, dx 0x0000005b mov cl, B9h 0x0000005d bt dx, bx 0x00000061 xchg dword ptr [esp], ecx 0x00000064 jmp 00007FD448BFA0CEh 0x00000066 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A396 second address: 000000006C88A359 instructions: 0x00000000 rdtsc 0x00000002 bswap ecx 0x00000004 mov dh, byte ptr [esp] 0x00000007 jmp 00007FD448BF5468h 0x0000000c add esi, 02h 0x0000000f btr cx, ax 0x00000013 jno 00007FD448BF566Dh 0x00000019 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A359 second address: 000000006C88A2DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFA041h 0x00000007 not cl 0x00000009 call 00007FD448BFA13Dh 0x0000000e lea edx, dword ptr [00000000h+esi*4] 0x00000015 mov cx, E8B9h 0x00000019 rcl dx, cl 0x0000001c btc cx, ax 0x00000020 xchg al, cl 0x00000022 jmp 00007FD448BFA0B9h 0x00000024 xchg dword ptr [esp], edi 0x00000027 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A2DB second address: 000000006C88A2D0 instructions: 0x00000000 rdtsc 0x00000002 btc eax, ebx 0x00000005 mov eax, edx 0x00000007 xchg ch, ah 0x00000009 lea edi, dword ptr [edi-0004D459h] 0x0000000f jmp 00007FD448BF5568h 0x00000011 mov eax, edi 0x00000013 mov dx, EA8Dh 0x00000017 lea ecx, dword ptr [ebx+52h] 0x0000001a xchg dword ptr [esp], edi 0x0000001d bswap edx 0x0000001f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88A2D0 second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFA145h 0x00000004 push dword ptr [esp] 0x00000007 retn 0004h 0x0000000a movzx ecx, byte ptr [ebp+00h] 0x0000000e jmp 00007FD448BFA0CFh 0x00000010 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83EAC9 second address: 000000006C83EEF8 instructions: 0x00000000 rdtsc 0x00000002 mov dl, F2h 0x00000004 bswap ecx 0x00000006 call 00007FD448BFA0CAh 0x0000000b jmp 00007FD448BFA11Bh 0x0000000d lea ebx, dword ptr [ebx+55h] 0x00000010 lea ecx, dword ptr [00000000h+ebx*4] 0x00000017 bsr bp, cx 0x0000001b rcl ecx, 19h 0x0000001e xchg dword ptr [esp+04h], ebx 0x00000022 jmp 00007FD448BFA54Bh 0x00000027 mov al, F1h 0x00000029 rcl bx, 1 0x0000002c inc bx 0x0000002e sub esp, 1Eh 0x00000031 ror ax, 0002h 0x00000035 lea esp, dword ptr [esp+02h] 0x00000039 jmp 00007FD448BFA0B0h 0x0000003b push dword ptr [esp+20h] 0x0000003f retn 0024h 0x00000042 lea edi, dword ptr [esp+0Ch] 0x00000046 mov dl, byte ptr [esp] 0x00000049 jmp 00007FD448BFA55Ah 0x0000004e sub esp, 000000B4h 0x00000054 mov ebp, esp 0x00000056 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C84B709 second address: 000000006C84B85B instructions: 0x00000000 rdtsc 0x00000002 mov ah, byte ptr [esp] 0x00000005 jmp 00007FD448BF55ADh 0x00000007 mov dh, byte ptr [esp] 0x0000000a jmp 00007FD448BF55C0h 0x0000000c mov ecx, edi 0x0000000e mov esi, dword ptr [ecx] 0x00000010 bsf ecx, ecx 0x00000013 jnp 00007FD448BF5573h 0x00000015 jmp 00007FD448BF5625h 0x0000001a mov al, 96h 0x0000001c xchg edx, ecx 0x0000001e add edi, 04h 0x00000021 jmp 00007FD448BF5549h 0x00000023 btc edx, esi 0x00000026 je 00007FD448BF5577h 0x00000028 bsr eax, edi 0x0000002b setnl dh 0x0000002e jmp 00007FD448BF55ACh 0x00000030 push ebp 0x00000031 lea ecx, dword ptr [ecx+esi] 0x00000034 call 00007FD448BF5572h 0x00000039 mov ch, byte ptr [esp] 0x0000003c push esi 0x0000003d jmp 00007FD448BF5612h 0x00000042 and ebp, esi 0x00000044 jns 00007FD448BF555Eh 0x00000046 mov cx, word ptr [esp] 0x0000004a mov cl, byte ptr [esp] 0x0000004d jmp 00007FD448BF556Fh 0x0000004f dec ax 0x00000051 push edi 0x00000052 mov dx, 9280h 0x00000056 mov dx, B8F4h 0x0000005a jmp 00007FD448BF55A8h 0x0000005c mov bp, word ptr [esp] 0x00000060 sbb ax, bp 0x00000063 jmp 00007FD448BF55D9h 0x00000065 jnc 00007FD448BF554Dh 0x00000067 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C84B85B second address: 000000006C84B903 instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [eax+ebx] 0x00000005 jmp 00007FD448BFA0CFh 0x00000007 cmp eax, 9DA45E12h 0x0000000c push si 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 jmp 00007FD448BFA11Eh 0x00000014 pop esi 0x00000015 mov al, dl 0x00000017 mov al, dl 0x00000019 clc 0x0000001a jnp 00007FD448BFA0D4h 0x0000001c jmp 00007FD448BFA184h 0x00000021 pop ebp 0x00000022 mov ch, 2Fh 0x00000024 mov ax, BE00h 0x00000028 or eax, ebx 0x0000002a jnle 00007FD448BFA0B1h 0x0000002c jle 00007FD448BFA099h 0x0000002e add esp, 04h 0x00000031 jnbe 00007FD448BFA11Bh 0x00000033 pushfd 0x00000034 mov cx, word ptr [esp+02h] 0x00000039 jmp 00007FD448BFA0D4h 0x0000003b lea edi, dword ptr [ecx+ebx] 0x0000003e mov edi, dword ptr [esp+04h] 0x00000042 mov edx, 6C4C3A78h 0x00000047 push dx 0x00000049 jmp 00007FD448BFA100h 0x0000004b lea esp, dword ptr [esp+02h] 0x0000004f lea esp, dword ptr [esp+08h] 0x00000053 call 00007FD448BFA121h 0x00000058 mov ax, dx 0x0000005b mov cl, B9h 0x0000005d bt dx, bx 0x00000061 xchg dword ptr [esp], ecx 0x00000064 jmp 00007FD448BFA0CEh 0x00000066 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C84B903 second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 sub edx, eax 0x00000004 mov ax, bx 0x00000007 add dx, dx 0x0000000a mov ah, E4h 0x0000000c jmp 00007FD448BF55A8h 0x0000000e lea ecx, dword ptr [ecx-0000ED1Ch] 0x00000014 mov dx, AE09h 0x00000018 mov eax, dword ptr [esp] 0x0000001b btc ax, si 0x0000001f call 00007FD448BF584Dh 0x00000024 xchg dword ptr [esp+04h], ecx 0x00000028 mov ch, byte ptr [esp] 0x0000002b jmp 00007FD448BF53C3h 0x00000030 sub esp, 16h 0x00000033 mov ax, word ptr [esp+07h] 0x00000038 mov ecx, dword ptr [esp+12h] 0x0000003c add esp, 07h 0x0000003f lea esp, dword ptr [esp+03h] 0x00000043 push dword ptr [esp+10h] 0x00000047 retn 0014h 0x0000004a mov ebx, ebp 0x0000004c lea eax, dword ptr [esp+ecx] 0x0000004f setle ah 0x00000052 sets dl 0x00000055 call 00007FD448BF556Fh 0x0000005a xchg cl, ch 0x0000005c pushad 0x0000005d rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83CBBE second address: 000000006C83CBE2 instructions: 0x00000000 rdtsc 0x00000002 mov al, bh 0x00000004 xchg dword ptr [esp+20h], esi 0x00000008 jmp 00007FD448BFA10Ch 0x0000000a rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83CBE2 second address: 000000006C83CCAF instructions: 0x00000000 rdtsc 0x00000002 xchg ecx, edx 0x00000004 mov ax, word ptr [esp] 0x00000008 mov edx, B68AAC39h 0x0000000d lea esi, dword ptr [esi-00000052h] 0x00000013 xchg eax, edx 0x00000014 jmp 00007FD448BF55B3h 0x00000016 mov edx, ecx 0x00000018 lea eax, dword ptr [00000000h+edi*4] 0x0000001f mov dx, 208Bh 0x00000023 xchg dword ptr [esp+20h], esi 0x00000027 mov cl, ch 0x00000029 xchg dx, ax 0x0000002c jmp 00007FD448BF5563h 0x0000002e xchg dx, ax 0x00000031 mov ecx, dword ptr [esp] 0x00000034 push dword ptr [esp+20h] 0x00000038 retn 0024h 0x0000003b mov eax, 12F33EA2h 0x00000040 xor cl, 00000044h 0x00000043 jnl 00007FD448BF5670h 0x00000049 pushfd 0x0000004a mov dx, cx 0x0000004d mov dh, 56h 0x0000004f lea eax, dword ptr [ebx-03h] 0x00000052 lea ecx, dword ptr [ecx-0F5291AAh] 0x00000058 lea esp, dword ptr [esp+04h] 0x0000005c sub ebp, 1284C013h 0x00000062 call 00007FD448BF55ACh 0x00000067 mov ecx, dword ptr [esp] 0x0000006a rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83CCAF second address: 000000006C83CC9D instructions: 0x00000000 rdtsc 0x00000002 neg al 0x00000004 neg al 0x00000006 push sp 0x00000008 jmp 00007FD448BFA0CFh 0x0000000a lea esp, dword ptr [esp+02h] 0x0000000e xchg dword ptr [esp], ebx 0x00000011 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83CC9D second address: 000000006C83CCC5 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 93656786h 0x00000007 jmp 00007FD448BF55A5h 0x00000009 mov edx, dword ptr [esp] 0x0000000c lea ebx, dword ptr [ebx-00000034h] 0x00000012 shr eax, 0Ch 0x00000015 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83CE39 second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFA0AFh 0x00000004 xor ebp, 2D4823BBh 0x0000000a mov ah, byte ptr [esp] 0x0000000d clc 0x0000000e je 00007FD448BFA0D0h 0x00000010 jne 00007FD448BFA0FAh 0x00000012 mov eax, 09013DC9h 0x00000017 sub esp, 19h 0x0000001a lea esp, dword ptr [esp+01h] 0x0000001e jmp 00007FD448BFA176h 0x00000023 add ebp, dword ptr [esi] 0x00000025 lea eax, dword ptr [00000000h+edx*4] 0x0000002c xchg ch, cl 0x0000002e jmp 00007FD448BFA09Dh 0x00000030 movzx ecx, byte ptr [ebp+00h] 0x00000034 jmp 00007FD448BFA0CFh 0x00000036 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83CE3D second address: 000000006C83CEB5 instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 jnbe 00007FD448BF55C6h 0x00000005 not ax 0x00000008 call 00007FD448BF5577h 0x0000000d mov ax, di 0x00000010 jmp 00007FD448BF55ABh 0x00000012 mov edx, dword ptr [esp] 0x00000015 add esp, 02h 0x00000018 jmp 00007FD448BF55EDh 0x0000001a jnle 00007FD448BF5539h 0x0000001c mov dl, dh 0x0000001e mov dh, byte ptr [esp+01h] 0x00000022 call 00007FD448BF55C9h 0x00000027 lea esp, dword ptr [esp+02h] 0x0000002b jmp 00007FD448BF5576h 0x0000002d add cl, bl 0x0000002f rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83D042 second address: 000000006C83D0C7 instructions: 0x00000000 rdtsc 0x00000002 btr eax, ebp 0x00000005 jnp 00007FD448BFA139h 0x00000007 mov dx, word ptr [esp] 0x0000000b jmp 00007FD448BFA122h 0x0000000d inc ebp 0x0000000e rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83DC6E second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 and cx, si 0x00000005 jnc 00007FD448BF55BEh 0x00000007 jmp 00007FD448BF557Ah 0x00000009 mov dx, word ptr [esp] 0x0000000d jmp 00007FD448BF55B8h 0x0000000f sub esp, 02h 0x00000012 jne 00007FD448BF55D1h 0x00000014 lea eax, dword ptr [esp+edi] 0x00000017 lea esp, dword ptr [esp+02h] 0x0000001b jmp 00007FD448BF55C4h 0x0000001d lea eax, dword ptr [edi+50h] 0x00000020 xchg dx, cx 0x00000023 stc 0x00000024 jc 00007FD448BF5518h 0x00000026 push di 0x00000028 lea esp, dword ptr [esp+02h] 0x0000002c jmp 00007FD448BF5606h 0x0000002e cmp esi, eax 0x00000030 jmp 00007FD448BF56CBh 0x00000035 jl 00007FD448BF545Bh 0x0000003b jnl 00007FD448BF5455h 0x00000041 ja 00007FD448BF46A1h 0x00000047 movzx ecx, byte ptr [ebp+00h] 0x0000004b jmp 00007FD448BF556Fh 0x0000004d rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C84DBDC second address: 000000006C84DDC5 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 stc 0x00000004 jnc 00007FD448BFA0B2h 0x00000006 shl bp, cl 0x00000009 jmp 00007FD448BFA191h 0x0000000e push esi 0x0000000f xchg bp, ax 0x00000012 pushfd 0x00000013 jmp 00007FD448BFA0A7h 0x00000015 inc bp 0x00000017 jnc 00007FD448BFA0CAh 0x00000019 jc 00007FD448BFA0C8h 0x0000001b push edi 0x0000001c xchg dh, dl 0x0000001e xchg dl, cl 0x00000020 jmp 00007FD448BFA0D5h 0x00000022 sub esp, 00000000h 0x00000025 jbe 00007FD448BFA10Ah 0x00000027 mov ecx, dword ptr [esp] 0x0000002a lea edx, dword ptr [esi+esi] 0x0000002d add dx, bx 0x00000030 jmp 00007FD448BFA13Bh 0x00000032 pop ebp 0x00000033 sub esp, 03h 0x00000036 jbe 00007FD448BFA0D3h 0x00000038 rol esi, cl 0x0000003a add esp, 01h 0x0000003d lea esp, dword ptr [esp+02h] 0x00000041 jmp 00007FD448BFA2B9h 0x00000046 add esp, 04h 0x00000049 jno 00007FD448BFA078h 0x0000004b pop edi 0x0000004c rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C848B7C second address: 000000006C848BB9 instructions: 0x00000000 rdtsc 0x00000002 lea ecx, dword ptr [00000000h+esi*4] 0x00000009 neg cx 0x0000000c jmp 00007FD448BF55BEh 0x0000000e lea eax, dword ptr [eax+ecx] 0x00000011 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C848BB9 second address: 000000006C848B0F instructions: 0x00000000 rdtsc 0x00000002 push dword ptr [esp+04h] 0x00000006 retn 0008h 0x00000009 sub ebp, 04h 0x0000000c rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C848B0F second address: 000000006C848C6A instructions: 0x00000000 rdtsc 0x00000002 xchg dh, ch 0x00000004 jmp 00007FD448BF572Dh 0x00000009 not eax 0x0000000b not ax 0x0000000e mov edx, edi 0x00000010 mov ecx, dword ptr [edx] 0x00000012 jmp 00007FD448BF553Fh 0x00000014 mov eax, edx 0x00000016 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C848C6A second address: 000000006C848C3A instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 jne 00007FD448BFA0BDh 0x00000005 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C849089 second address: 000000006C84907A instructions: 0x00000000 rdtsc 0x00000002 pop eax 0x00000003 lea esi, dword ptr [esi-00000153h] 0x00000009 mov dh, BBh 0x0000000b mov dh, byte ptr [esp] 0x0000000e jmp 00007FD448BF555Fh 0x00000010 mov eax, 75B25F11h 0x00000015 lea edx, dword ptr [00000000h+eax*4] 0x0000001c xchg dword ptr [esp+10h], esi 0x00000020 push edi 0x00000021 mov byte ptr [esp], al 0x00000024 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C8534FB second address: 000000006C85353D instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 call 00007FD448BFA0D3h 0x00000008 push esp 0x00000009 mov esi, dword ptr [esp+03h] 0x0000000d bswap eax 0x0000000f mov byte ptr [esp+01h], cl 0x00000013 mov word ptr [esp+01h], sp 0x00000018 jmp 00007FD448BFA119h 0x0000001a xchg dword ptr [esp+04h], ebp 0x0000001e pushad 0x0000001f inc cx 0x00000021 bsf di, bx 0x00000025 pop esi 0x00000026 clc 0x00000027 jmp 00007FD448BFA0CDh 0x00000029 lea ebp, dword ptr [ebp-0000003Ch] 0x0000002f mov cl, dl 0x00000031 bsr edi, ecx 0x00000034 cmc 0x00000035 cmc 0x00000036 jmp 00007FD448BFA13Dh 0x00000038 xchg dword ptr [esp+20h], ebp 0x0000003c inc cl 0x0000003e cmc 0x0000003f setne dh 0x00000042 lea edi, dword ptr [ecx+ebp] 0x00000045 push dword ptr [esp+20h] 0x00000049 retn 0024h 0x0000004c bswap edx 0x0000004e jmp 00007FD448BFA164h 0x00000050 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C85353D second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 lea edx, dword ptr [ecx+000000CFh] 0x00000008 mov cl, ch 0x0000000a mov al, 0Ch 0x0000000c mov esi, eax 0x0000000e sub esp, 0Bh 0x00000011 jmp 00007FD448BF55B4h 0x00000013 jle 00007FD448BF55B0h 0x00000015 mov al, ah 0x00000017 lea esp, dword ptr [esp+03h] 0x0000001b jmp 00007FD448BF55AEh 0x0000001d jmp 00007FD448BF5574h 0x0000001f add esp, 08h 0x00000022 jo 00007FD448BF55C1h 0x00000024 jno 00007FD448BF55BFh 0x00000026 pop esi 0x00000027 xchg ch, al 0x00000029 pushfd 0x0000002a jmp 00007FD448BF5576h 0x0000002c mov cl, 90h 0x0000002e bswap edx 0x00000030 jmp 00007FD448BF55A8h 0x00000032 add esp, 04h 0x00000035 jmp 00007FD448BF56AEh 0x0000003a jne 00007FD448BF5478h 0x00000040 pop ebp 0x00000041 mov di, word ptr [esp] 0x00000045 xchg ah, al 0x00000047 mov ah, 7Dh 0x00000049 jmp 00007FD448BF564Ch 0x0000004e bsr ax, bp 0x00000052 jnbe 00007FD448BF551Ch 0x00000054 pop edi 0x00000055 jmp 00007FD448BDEB4Ch 0x0000005a mov ebx, ebp 0x0000005c lea eax, dword ptr [esp+ecx] 0x0000005f setle ah 0x00000062 sets dl 0x00000065 call 00007FD448BF556Fh 0x0000006a xchg cl, ch 0x0000006c pushad 0x0000006d rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C84BA9C second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 mov eax, dword ptr [esp] 0x00000005 jmp 00007FD448BEB4A9h 0x0000000a movzx ecx, byte ptr [ebp+00h] 0x0000000e jmp 00007FD448BFA0CFh 0x00000010 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C851465 second address: 000000006C85146C instructions: 0x00000000 rdtsc 0x00000002 not ah 0x00000004 ror cl, 00000000h 0x00000007 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C853196 second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 stc 0x00000003 jmp 00007FD448BFA218h 0x00000008 jo 00007FD448BF9FCEh 0x0000000e mov edx, 4C97B051h 0x00000013 neg edx 0x00000015 jmp 00007FD448BFA073h 0x00000017 mov eax, dword ptr [esi] 0x0000001a setnl dh 0x0000001d jmp 00007FD448BFA10Ch 0x0000001f mov dh, cl 0x00000021 call 00007FD448BFA0D4h 0x00000026 sub esi, 04h 0x00000029 mov edx, esi 0x0000002b lea edx, dword ptr [esp+esi] 0x0000002e pushfd 0x0000002f jmp 00007FD448BFA11Eh 0x00000031 btc ecx, ecx 0x00000034 jle 00007FD448BFA0D7h 0x00000036 jnle 00007FD448BFA0D5h 0x00000038 mov dword ptr [esi], eax 0x0000003a lea ecx, dword ptr [ebp+00003F07h] 0x00000040 bts cx, bx 0x00000044 jmp 00007FD448BFA179h 0x00000049 jc 00007FD448BFA078h 0x0000004b xchg dh, cl 0x0000004d mov dx, FA48h 0x00000051 jmp 00007FD448BF869Ch 0x00000056 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C851BCB second address: 000000006C851E93 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 11h 0x00000005 mov word ptr [esp+07h], ax 0x0000000a inc dx 0x0000000c jmp 00007FD448BF55ADh 0x0000000e lea esp, dword ptr [esp+01h] 0x00000012 lea edi, dword ptr [edi-0000002Bh] 0x00000018 bswap edx 0x0000001a adc edx, ecx 0x0000001c dec dh 0x0000001e setb ah 0x00000021 jmp 00007FD448BF5BDFh 0x00000026 xchg dword ptr [esp+10h], edi 0x0000002a bsr eax, ecx 0x0000002d sub eax, esi 0x0000002f push dword ptr [esp+10h] 0x00000033 retn 0014h 0x00000036 mov edx, eax 0x00000038 mov eax, ebp 0x0000003a btr eax, ebp 0x0000003d jmp 00007FD448BF59A0h 0x00000042 jl 00007FD448BF572Ah 0x00000048 mov eax, esi 0x0000004a inc cl 0x0000004c bsr dx, ax 0x00000050 jmp 00007FD448BF51E9h 0x00000055 jnp 00007FD448BF566Eh 0x0000005b mov edx, dword ptr [esp] 0x0000005e xchg eax, edx 0x0000005f jmp 00007FD448BF5471h 0x00000064 bsf edx, ebp 0x00000067 jmp 00007FD448BF5787h 0x0000006c pushad 0x0000006d rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C85345B second address: 000000006C8534FB instructions: 0x00000000 rdtsc 0x00000002 mov ch, bh 0x00000004 stc 0x00000005 mov eax, dword ptr [esp] 0x00000008 jmp 00007FD448BFA109h 0x0000000a mov dl, E0h 0x0000000c push dword ptr [esp+18h] 0x00000010 retn 001Ch 0x00000013 mov edi, dword ptr [ebp+00h] 0x00000016 lea eax, dword ptr [edx+ebx] 0x00000019 setnle cl 0x0000001c mov eax, B0A52D3Ah 0x00000021 jmp 00007FD448BFA2D9h 0x00000026 push bx 0x00000028 lea esp, dword ptr [esp+02h] 0x0000002c add ebp, 04h 0x0000002f mov dx, word ptr [esp] 0x00000033 mov ecx, edx 0x00000035 jmp 00007FD448BFA035h 0x0000003a push esi 0x0000003b neg ah 0x0000003d jnle 00007FD448BFA097h 0x0000003f not ch 0x00000041 cmc 0x00000042 jmp 00007FD448BFA072h 0x00000044 push edi 0x00000045 neg ecx 0x00000047 jne 00007FD448BFA0D6h 0x00000049 jmp 00007FD448BFA144h 0x0000004b clc 0x0000004c rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C84AD3A second address: 000000006C83CBBE instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [00000000h+ebx*4] 0x00000009 mov ecx, D5B43DB6h 0x0000000e jmp 00007FD448BE7419h 0x00000013 mov ebx, ebp 0x00000015 lea eax, dword ptr [esp+ecx] 0x00000018 setle ah 0x0000001b sets dl 0x0000001e call 00007FD448BF556Fh 0x00000023 xchg cl, ch 0x00000025 pushad 0x00000026 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C85457D second address: 000000006C85457F instructions: 0x00000000 rdtsc 0x00000002 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C84E1D1 second address: 000000006C84E3D9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 xchg word ptr [esp], ax 0x00000007 lea ecx, dword ptr [ecx+esi] 0x0000000a xchg dword ptr [esp+04h], esi 0x0000000e jmp 00007FD448BFA0F6h 0x00000010 cmc 0x00000011 neg al 0x00000013 dec cx 0x00000015 lea ecx, dword ptr [00000000h+edi*4] 0x0000001c mov eax, 63E4BEA4h 0x00000021 jmp 00007FD448BFA2D0h 0x00000026 lea esi, dword ptr [esi+2Ah] 0x00000029 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C8621EC second address: 000000006C8621EE instructions: 0x00000000 rdtsc 0x00000002 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C87288F second address: 000000006C87288F instructions: 0x00000000 rdtsc 0x00000002 mov di, word ptr [esp] 0x00000006 mov dword ptr [esp+1Ch], ebp 0x0000000a popad 0x0000000b jmp 00007FD448BFA10Eh 0x0000000d lea eax, dword ptr [eax+74h] 0x00000010 mov ecx, dword ptr [eax] 0x00000012 pop eax 0x00000013 jmp 00007FD448BFA112h 0x00000015 dec dword ptr [ebp+74h] 0x00000018 sub esp, 16h 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f jmp 00007FD448BFA124h 0x00000021 lea esp, dword ptr [esp+14h] 0x00000025 test ecx, ecx 0x00000027 jne 00007FD448BFA04Eh 0x0000002d mov byte ptr [eax], 00000000h 0x00000030 jmp 00007FD448BFA0F6h 0x00000032 inc eax 0x00000033 jmp 00007FD448BFA0C0h 0x00000035 push eax 0x00000036 jmp 00007FD448BFA121h 0x00000038 pushad 0x00000039 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899DB9 second address: 000000006C899ED1 instructions: 0x00000000 rdtsc 0x00000002 setnle cl 0x00000005 setb cl 0x00000008 jmp 00007FD448BF55E1h 0x0000000a sub edi, 08h 0x0000000d xchg ch, cl 0x0000000f bsr ecx, ebx 0x00000012 je 00007FD448BF5572h 0x00000014 jne 00007FD448BF5D83h 0x0000001a neg ch 0x0000001c jmp 00007FD448BF546Fh 0x00000021 pushad 0x00000022 xchg eax, esi 0x00000023 sub esp, 0Fh 0x00000026 jbe 00007FD448BF5511h 0x0000002c xchg word ptr [esp+06h], ax 0x00000031 mov dx, 2507h 0x00000035 lea esp, dword ptr [esp+03h] 0x00000039 mov dword ptr [esp+24h], edi 0x0000003d lea esp, dword ptr [esp+0Ch] 0x00000041 jmp 00007FD448BF4F9Fh 0x00000046 popad 0x00000047 mov dword ptr [ecx], edx 0x00000049 jmp 00007FD448BF54C5h 0x0000004e rcr ch, cl 0x00000050 jbe 00007FD448BF5578h 0x00000052 setno ch 0x00000055 jmp 00007FD448BF55EAh 0x00000057 mov edx, edi 0x00000059 add edx, 04h 0x0000005c jnl 00007FD448BF5563h 0x0000005e jmp 00007FD448BF557Ah 0x00000060 mov dword ptr [edx], eax 0x00000062 bsf eax, ebp 0x00000065 call 00007FD448BF55A3h 0x0000006a pop word ptr [esp] 0x0000006e lea esp, dword ptr [esp+02h] 0x00000072 call 00007FD448BF5596h 0x00000077 jmp 00007FD448BF55CCh 0x00000079 shl eax, 03h 0x0000007c lea edx, dword ptr [00000000h+ebp*4] 0x00000083 inc cx 0x00000085 lea ecx, dword ptr [eax+edi] 0x00000088 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899ED1 second address: 000000006C899EEE instructions: 0x00000000 rdtsc 0x00000002 xchg dword ptr [esp], ebx 0x00000005 jmp 00007FD448BFA0A2h 0x00000007 not ah 0x00000009 mov eax, DB0AC25Ah 0x0000000e mov edx, F128A53Ch 0x00000013 pushfd 0x00000014 jmp 00007FD448BFA107h 0x00000016 lea ebx, dword ptr [ebx-00044E40h] 0x0000001c mov dx, word ptr [esp] 0x00000020 mov dh, cl 0x00000022 neg dx 0x00000025 jmp 00007FD448BFA123h 0x00000027 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899EEE second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 btc eax, esp 0x00000005 xchg dword ptr [esp+04h], ebx 0x00000009 mov cx, 5D6Fh 0x0000000d xchg cx, ax 0x00000010 sub esp, 1Eh 0x00000013 jmp 00007FD448BF5567h 0x00000015 mov dl, bl 0x00000017 not cx 0x0000001a lea esp, dword ptr [esp+02h] 0x0000001e push dword ptr [esp+20h] 0x00000022 retn 0024h 0x00000025 jmp 00007FD448BF55D8h 0x00000027 stc 0x00000028 jnle 00007FD448BF5549h 0x0000002a bsf cx, di 0x0000002e rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C882D5E second address: 000000006C882CA4 instructions: 0x00000000 rdtsc 0x00000002 mov ax, sp 0x00000005 jmp 00007FD448BFA02Eh 0x0000000a lea eax, dword ptr [edi+edi] 0x0000000d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C882CA4 second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BC4133h 0x00000007 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88B6DE second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 mov word ptr [edi], cx 0x00000005 bswap eax 0x00000007 setb al 0x0000000a inc cx 0x0000000c jmp 00007FD448BFA121h 0x0000000e jne 00007FD448BFA0C5h 0x00000010 jmp 00007FD448BC3A45h 0x00000015 jmp 00007FD448BFA138h 0x00000017 stc 0x00000018 jnle 00007FD448BFA0A9h 0x0000001a bsf cx, di 0x0000001e rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C8534C3 second address: 000000006C85353D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF55C8h 0x00000004 push ebp 0x00000005 call 00007FD448BF5573h 0x0000000a push esp 0x0000000b mov esi, dword ptr [esp+03h] 0x0000000f bswap eax 0x00000011 mov byte ptr [esp+01h], cl 0x00000015 mov word ptr [esp+01h], sp 0x0000001a jmp 00007FD448BF55B9h 0x0000001c xchg dword ptr [esp+04h], ebp 0x00000020 pushad 0x00000021 inc cx 0x00000023 bsf di, bx 0x00000027 pop esi 0x00000028 clc 0x00000029 jmp 00007FD448BF556Dh 0x0000002b lea ebp, dword ptr [ebp-0000003Ch] 0x00000031 mov cl, dl 0x00000033 bsr edi, ecx 0x00000036 cmc 0x00000037 cmc 0x00000038 jmp 00007FD448BF55DDh 0x0000003a xchg dword ptr [esp+20h], ebp 0x0000003e inc cl 0x00000040 cmc 0x00000041 setne dh 0x00000044 lea edi, dword ptr [ecx+ebp] 0x00000047 push dword ptr [esp+20h] 0x0000004b retn 0024h 0x0000004e bswap edx 0x00000050 jmp 00007FD448BF5604h 0x00000052 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88EFCD second address: 000000006C84EEEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD448BFA0D7h 0x00000008 sub esi, 08h 0x0000000b pushfd 0x0000000c jmp 00007FD448BFA137h 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 lea esp, dword ptr [esp+02h] 0x00000016 xchg edx, ecx 0x00000018 call 00007FD448BFA0D0h 0x0000001d add esp, 01h 0x00000020 jnle 00007FD448BFA128h 0x00000022 jmp 00007FD448BFA0DAh 0x00000024 lea esp, dword ptr [esp+03h] 0x00000028 jmp 00007FD448BFA104h 0x0000002a mov dword ptr [esi], ecx 0x0000002c mov ecx, edx 0x0000002e mov cx, word ptr [esp] 0x00000032 bsf ecx, ebx 0x00000035 jmp 00007FD448BFA13Fh 0x00000037 jnle 00007FD448BFA0A7h 0x00000039 mov cx, 166Ah 0x0000003d jmp 00007FD448BFA111h 0x0000003f mov dword ptr [esi+04h], eax 0x00000042 push dx 0x00000044 add esp, 01h 0x00000047 jmp 00007FD448BFA12Ah 0x00000049 jnle 00007FD448BFA0BCh 0x0000004b xchg byte ptr [esp], ah 0x0000004e lea esp, dword ptr [esp+01h] 0x00000052 jmp 00007FD448BB9F63h 0x00000057 mov cl, byte ptr [esp] 0x0000005a rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C884C1C second address: 000000006C884C48 instructions: 0x00000000 rdtsc 0x00000002 sub ebp, 02h 0x00000005 neg cx 0x00000008 js 00007FD448BF55ACh 0x0000000a add edx, 213E919Dh 0x00000010 mov edx, eax 0x00000012 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89FABF second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 03h 0x00000005 jl 00007FD448BFA127h 0x00000007 mov word ptr [esp], sp 0x0000000b push word ptr [esp+02h] 0x00000010 sub esp, 16h 0x00000013 lea esp, dword ptr [esp+03h] 0x00000017 jmp 00007FD448BFA2AAh 0x0000001c sub esi, 08h 0x0000001f pushad 0x00000020 cmc 0x00000021 jl 00007FD448BF9FF2h 0x00000027 jnl 00007FD448BF9FECh 0x0000002d call 00007FD448BFA0D1h 0x00000032 pop dword ptr [esp+10h] 0x00000036 jmp 00007FD448BFA0D6h 0x00000038 xchg edx, ecx 0x0000003a clc 0x0000003b jnp 00007FD448BFA109h 0x0000003d mov dword ptr [esi], ecx 0x0000003f jmp 00007FD448BFA143h 0x00000041 mov ch, 19h 0x00000043 mov cx, 60D1h 0x00000047 lea ecx, dword ptr [00000000h+ebx*4] 0x0000004e bsr ecx, edi 0x00000051 jle 00007FD448BFA0BFh 0x00000053 jnle 00007FD448BFA0BDh 0x00000055 jmp 00007FD448BFA0DAh 0x00000057 mov ecx, esi 0x00000059 jmp 00007FD448BFA106h 0x0000005b add ecx, 04h 0x0000005e jmp 00007FD448BFA13Fh 0x00000060 jne 00007FD448BFA0A7h 0x00000062 mov dword ptr [ecx], eax 0x00000064 bswap eax 0x00000066 mov ecx, esi 0x00000068 jmp 00007FD448BABD76h 0x0000006d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C87288F second address: 000000006C87288F instructions: 0x00000000 rdtsc 0x00000002 mov di, word ptr [esp] 0x00000006 mov dword ptr [esp+1Ch], ebp 0x0000000a popad 0x0000000b jmp 00007FD448BF55AEh 0x0000000d lea eax, dword ptr [eax+74h] 0x00000010 mov ecx, dword ptr [eax] 0x00000012 pop eax 0x00000013 jmp 00007FD448BF55B2h 0x00000015 dec dword ptr [ebp+74h] 0x00000018 sub esp, 16h 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f jmp 00007FD448BF55C4h 0x00000021 lea esp, dword ptr [esp+14h] 0x00000025 test ecx, ecx 0x00000027 jne 00007FD448BF54EEh 0x0000002d mov byte ptr [eax], 00000000h 0x00000030 jmp 00007FD448BF5596h 0x00000032 inc eax 0x00000033 jmp 00007FD448BF5560h 0x00000035 push eax 0x00000036 jmp 00007FD448BF55C1h 0x00000038 pushad 0x00000039 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899DB9 second address: 000000006C899ED1 instructions: 0x00000000 rdtsc 0x00000002 setnle cl 0x00000005 setb cl 0x00000008 jmp 00007FD448BFA141h 0x0000000a sub edi, 08h 0x0000000d xchg ch, cl 0x0000000f bsr ecx, ebx 0x00000012 je 00007FD448BFA0D2h 0x00000014 jne 00007FD448BFA8E3h 0x0000001a neg ch 0x0000001c jmp 00007FD448BF9FCFh 0x00000021 pushad 0x00000022 xchg eax, esi 0x00000023 sub esp, 0Fh 0x00000026 jbe 00007FD448BFA071h 0x0000002c xchg word ptr [esp+06h], ax 0x00000031 mov dx, 2507h 0x00000035 lea esp, dword ptr [esp+03h] 0x00000039 mov dword ptr [esp+24h], edi 0x0000003d lea esp, dword ptr [esp+0Ch] 0x00000041 jmp 00007FD448BF9AFFh 0x00000046 popad 0x00000047 mov dword ptr [ecx], edx 0x00000049 jmp 00007FD448BFA025h 0x0000004e rcr ch, cl 0x00000050 jbe 00007FD448BFA0D8h 0x00000052 setno ch 0x00000055 jmp 00007FD448BFA14Ah 0x00000057 mov edx, edi 0x00000059 add edx, 04h 0x0000005c jnl 00007FD448BFA0C3h 0x0000005e jmp 00007FD448BFA0DAh 0x00000060 mov dword ptr [edx], eax 0x00000062 bsf eax, ebp 0x00000065 call 00007FD448BFA103h 0x0000006a pop word ptr [esp] 0x0000006e lea esp, dword ptr [esp+02h] 0x00000072 call 00007FD448BFA0F6h 0x00000077 jmp 00007FD448BFA12Ch 0x00000079 shl eax, 03h 0x0000007c lea edx, dword ptr [00000000h+ebp*4] 0x00000083 inc cx 0x00000085 lea ecx, dword ptr [eax+edi] 0x00000088 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899ED1 second address: 000000006C899EEE instructions: 0x00000000 rdtsc 0x00000002 xchg dword ptr [esp], ebx 0x00000005 jmp 00007FD448BF5542h 0x00000007 not ah 0x00000009 mov eax, DB0AC25Ah 0x0000000e mov edx, F128A53Ch 0x00000013 pushfd 0x00000014 jmp 00007FD448BF55A7h 0x00000016 lea ebx, dword ptr [ebx-00044E40h] 0x0000001c mov dx, word ptr [esp] 0x00000020 mov dh, cl 0x00000022 neg dx 0x00000025 jmp 00007FD448BF55C3h 0x00000027 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899EEE second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 btc eax, esp 0x00000005 xchg dword ptr [esp+04h], ebx 0x00000009 mov cx, 5D6Fh 0x0000000d xchg cx, ax 0x00000010 sub esp, 1Eh 0x00000013 jmp 00007FD448BFA0C7h 0x00000015 mov dl, bl 0x00000017 not cx 0x0000001a lea esp, dword ptr [esp+02h] 0x0000001e push dword ptr [esp+20h] 0x00000022 retn 0024h 0x00000025 jmp 00007FD448BFA138h 0x00000027 stc 0x00000028 jnle 00007FD448BFA0A9h 0x0000002a bsf cx, di 0x0000002e rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C862145 second address: 000000006C862238 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 jmp 00007FD448BF55C5h 0x00000006 xchg dword ptr [esp], ecx 0x00000009 mov al, 6Ah 0x0000000b ror ax, cl 0x0000000e setb dh 0x00000011 bsf eax, eax 0x00000014 lea edx, dword ptr [ecx-1DD4EFFBh] 0x0000001a jmp 00007FD448BF5566h 0x0000001c lea ecx, dword ptr [ecx-00000024h] 0x00000022 not edx 0x00000024 push edi 0x00000025 mov dx, word ptr [esp+03h] 0x0000002a jmp 00007FD448BF55E2h 0x0000002c xchg dword ptr [esp+04h], ecx 0x00000030 bswap edx 0x00000032 lea eax, dword ptr [00000000h+ecx*4] 0x00000039 mov ah, EDh 0x0000003b push dword ptr [esp+04h] 0x0000003f retn 0008h 0x00000042 stc 0x00000043 jbe 00007FD448BF561Ch 0x00000049 call 00007FD448BF57B3h 0x0000004e xchg edx, eax 0x00000050 mov eax, edi 0x00000052 mov dx, bp 0x00000055 push edi 0x00000056 xchg dword ptr [esp+04h], ecx 0x0000005a jmp 00007FD448BF53FDh 0x0000005f mov ah, 99h 0x00000061 sub esp, 01h 0x00000064 neg dx 0x00000067 mov byte ptr [esp], dh 0x0000006a cmc 0x0000006b lea esp, dword ptr [esp+01h] 0x0000006f jmp 00007FD448BF5562h 0x00000071 lea ecx, dword ptr [ecx+34h] 0x00000074 call 00007FD448BF5577h 0x00000079 mov word ptr [esp], ax 0x0000007d lea edx, dword ptr [edi+2Dh] 0x00000080 lea eax, dword ptr [00000000h+edx*4] 0x00000087 jmp 00007FD448BF55A0h 0x00000089 xchg dword ptr [esp+08h], ecx 0x0000008d mov al, bl 0x0000008f sub esp, 0Ah 0x00000092 mov dword ptr [esp+04h], esi 0x00000096 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C83A7C8 second address: 000000006C83A807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFA0CCh 0x00000004 sub esp, 000000A0h 0x0000000a call 00007FD448BFA145h 0x0000000f setno bl 0x00000012 mov al, byte ptr [esp] 0x00000015 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C8539C4 second address: 000000006C8539F9 instructions: 0x00000000 rdtsc 0x00000002 lea esp, dword ptr [esp+02h] 0x00000006 jmp 00007FD448BF5565h 0x00000008 lea ebp, dword ptr [ebp-00000520h] 0x0000000e xchg eax, edx 0x0000000f lea eax, dword ptr [00000000h+ecx*4] 0x00000016 jmp 00007FD448BF55CCh 0x00000018 mov dx, bp 0x0000001b lea eax, dword ptr [edi+ebp] 0x0000001e not eax 0x00000020 xchg dword ptr [esp+3Ch], ebp 0x00000024 bsf dx, di 0x00000028 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C88A396 second address: 000000006C88A359 instructions: 0x00000000 rdtsc 0x00000002 bswap ecx 0x00000004 mov dh, byte ptr [esp] 0x00000007 jmp 00007FD448BF9FC8h 0x0000000c add esi, 02h 0x0000000f btr cx, ax 0x00000013 jno 00007FD448BFA1CDh 0x00000019 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C88A359 second address: 000000006C88A2DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF54E1h 0x00000007 not cl 0x00000009 call 00007FD448BF55DDh 0x0000000e lea edx, dword ptr [00000000h+esi*4] 0x00000015 mov cx, E8B9h 0x00000019 rcl dx, cl 0x0000001c btc cx, ax 0x00000020 xchg al, cl 0x00000022 jmp 00007FD448BF5559h 0x00000024 xchg dword ptr [esp], edi 0x00000027 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C88A2DB second address: 000000006C88A2D0 instructions: 0x00000000 rdtsc 0x00000002 btc eax, ebx 0x00000005 mov eax, edx 0x00000007 xchg ch, ah 0x00000009 lea edi, dword ptr [edi-0004D459h] 0x0000000f jmp 00007FD448BFA0C8h 0x00000011 mov eax, edi 0x00000013 mov dx, EA8Dh 0x00000017 lea ecx, dword ptr [ebx+52h] 0x0000001a xchg dword ptr [esp], edi 0x0000001d bswap edx 0x0000001f rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C88A2D0 second address: 000000006C83CE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF55E5h 0x00000004 push dword ptr [esp] 0x00000007 retn 0004h 0x0000000a movzx ecx, byte ptr [ebp+00h] 0x0000000e jmp 00007FD448BF556Fh 0x00000010 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C889B34 second address: 000000006C889BA7 instructions: 0x00000000 rdtsc 0x00000002 ror eax, 0Bh 0x00000005 je 00007FD448BFA0B0h 0x00000007 bswap eax 0x00000009 mov ah, byte ptr [esp] 0x0000000c mov dx, bp 0x0000000f call 00007FD448BFA0F6h 0x00000014 mov edx, ebp 0x00000016 mov dh, ch 0x00000018 lea eax, dword ptr [ebp+ebp+00h] 0x0000001c sub esp, 19h 0x0000001f lea esp, dword ptr [esp+01h] 0x00000023 jmp 00007FD448BFA135h 0x00000025 xchg dword ptr [esp+18h], esi 0x00000029 xchg edx, eax 0x0000002b mov dx, C92Fh 0x0000002f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89CF3F second address: 000000006C89CEDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF6139h 0x00000007 mov dx, word ptr [esp] 0x0000000b push dword ptr [esp+04h] 0x0000000f retn 0008h 0x00000012 lea esp, dword ptr [esp+02h] 0x00000016 mov ecx, dword ptr [ebp+00h] 0x00000019 mov dx, 4C2Eh 0x0000001d jmp 00007FD448BF5597h 0x0000001f mov dh, byte ptr [esp] 0x00000022 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89FABF second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 03h 0x00000005 jl 00007FD448BFA127h 0x00000007 mov word ptr [esp], sp 0x0000000b push word ptr [esp+02h] 0x00000010 sub esp, 16h 0x00000013 lea esp, dword ptr [esp+03h] 0x00000017 jmp 00007FD448BFA2AAh 0x0000001c sub esi, 08h 0x0000001f pushad 0x00000020 cmc 0x00000021 jl 00007FD448BF9FF2h 0x00000027 jnl 00007FD448BF9FECh 0x0000002d call 00007FD448BFA0D1h 0x00000032 pop dword ptr [esp+10h] 0x00000036 jmp 00007FD448BFA0D6h 0x00000038 xchg edx, ecx 0x0000003a clc 0x0000003b jnp 00007FD448BFA109h 0x0000003d jp 00007FD448BFA107h 0x0000003f mov dword ptr [esi], ecx 0x00000041 jmp 00007FD448BFA143h 0x00000043 mov ch, 19h 0x00000045 mov cx, 60D1h 0x00000049 lea ecx, dword ptr [00000000h+ebx*4] 0x00000050 bsr ecx, edi 0x00000053 jle 00007FD448BFA0BFh 0x00000055 jnle 00007FD448BFA0BDh 0x00000057 jmp 00007FD448BFA0DAh 0x00000059 mov ecx, esi 0x0000005b jmp 00007FD448BFA106h 0x0000005d add ecx, 04h 0x00000060 jmp 00007FD448BFA13Fh 0x00000062 jne 00007FD448BFA0A7h 0x00000064 mov dword ptr [ecx], eax 0x00000066 bswap eax 0x00000068 mov ecx, esi 0x0000006a jmp 00007FD448BABD76h 0x0000006f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899DB9 second address: 000000006C899ED1 instructions: 0x00000000 rdtsc 0x00000002 setnle cl 0x00000005 setb cl 0x00000008 jmp 00007FD448BF55E1h 0x0000000a sub edi, 08h 0x0000000d xchg ch, cl 0x0000000f bsr ecx, ebx 0x00000012 je 00007FD448BF5572h 0x00000014 jne 00007FD448BF5D83h 0x0000001a neg ch 0x0000001c jmp 00007FD448BF546Fh 0x00000021 pushad 0x00000022 xchg eax, esi 0x00000023 sub esp, 0Fh 0x00000026 jbe 00007FD448BF5511h 0x0000002c xchg word ptr [esp+06h], ax 0x00000031 mov dx, 2507h 0x00000035 lea esp, dword ptr [esp+03h] 0x00000039 mov dword ptr [esp+24h], edi 0x0000003d lea esp, dword ptr [esp+0Ch] 0x00000041 jmp 00007FD448BF4F9Fh 0x00000046 popad 0x00000047 mov dword ptr [ecx], edx 0x00000049 jmp 00007FD448BF54C5h 0x0000004e rcr ch, cl 0x00000050 jbe 00007FD448BF5578h 0x00000052 setno ch 0x00000055 jmp 00007FD448BF55D0h 0x00000057 mov edx, edi 0x00000059 add edx, 04h 0x0000005c jnl 00007FD448BF5563h 0x0000005e jmp 00007FD448BF557Ah 0x00000060 mov dword ptr [edx], eax 0x00000062 bsf eax, ebp 0x00000065 call 00007FD448BF55A3h 0x0000006a pop word ptr [esp] 0x0000006e lea esp, dword ptr [esp+02h] 0x00000072 call 00007FD448BF5596h 0x00000077 jmp 00007FD448BF55CCh 0x00000079 shl eax, 03h 0x0000007c lea edx, dword ptr [00000000h+ebp*4] 0x00000083 inc cx 0x00000085 lea ecx, dword ptr [eax+edi] 0x00000088 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89AF6D second address: 000000006C89AF32 instructions: 0x00000000 rdtsc 0x00000002 neg eax 0x00000004 jmp 00007FD448BFA08Fh 0x00000006 jc 00007FD448BFA10Fh 0x00000008 mov eax, dword ptr [esp] 0x0000000b rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C889B34 second address: 000000006C889BA7 instructions: 0x00000000 rdtsc 0x00000002 ror eax, 0Bh 0x00000005 je 00007FD448BF5550h 0x00000007 bswap eax 0x00000009 mov ah, byte ptr [esp] 0x0000000c mov dx, bp 0x0000000f call 00007FD448BF5596h 0x00000014 mov edx, ebp 0x00000016 mov dh, ch 0x00000018 lea eax, dword ptr [ebp+ebp+00h] 0x0000001c sub esp, 19h 0x0000001f lea esp, dword ptr [esp+01h] 0x00000023 jmp 00007FD448BF55D5h 0x00000025 xchg dword ptr [esp+18h], esi 0x00000029 xchg edx, eax 0x0000002b mov dx, C92Fh 0x0000002f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89CF3F second address: 000000006C89CEDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFAC99h 0x00000007 mov dx, word ptr [esp] 0x0000000b push dword ptr [esp+04h] 0x0000000f retn 0008h 0x00000012 lea esp, dword ptr [esp+02h] 0x00000016 mov ecx, dword ptr [ebp+00h] 0x00000019 mov dx, 4C2Eh 0x0000001d jmp 00007FD448BFA0F7h 0x0000001f mov dh, byte ptr [esp] 0x00000022 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89AF6D second address: 000000006C89AF32 instructions: 0x00000000 rdtsc 0x00000002 neg eax 0x00000004 jmp 00007FD448BF552Fh 0x00000006 jc 00007FD448BF55AFh 0x00000008 mov eax, dword ptr [esp] 0x0000000b rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C87288F second address: 000000006C87288F instructions: 0x00000000 rdtsc 0x00000002 mov di, word ptr [esp] 0x00000006 mov dword ptr [esp+1Ch], ebp 0x0000000a popad 0x0000000b jmp 00007FD448BFA10Eh 0x0000000d lea eax, dword ptr [eax+74h] 0x00000010 mov ecx, dword ptr [eax] 0x00000012 pop eax 0x00000013 jmp 00007FD448BFA112h 0x00000015 dec dword ptr [ebp+74h] 0x00000018 sub esp, 16h 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f jmp 00007FD448BFA124h 0x00000021 lea esp, dword ptr [esp+14h] 0x00000025 test ecx, ecx 0x00000027 jne 00007FD448BFA04Eh 0x0000002d mov byte ptr [eax], 00000000h 0x00000030 jmp 00007FD448BFA0F6h 0x00000032 inc eax 0x00000033 jmp 00007FD448BFA0C0h 0x00000035 push eax 0x00000036 jmp 00007FD448BFA121h 0x00000038 pushad 0x00000039 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C899DB9 second address: 000000006C899ED1 instructions: 0x00000000 rdtsc 0x00000002 setnle cl 0x00000005 setb cl 0x00000008 jmp 00007FD448BF55E1h 0x0000000a sub edi, 08h 0x0000000d xchg ch, cl 0x0000000f bsr ecx, ebx 0x00000012 je 00007FD448BF5572h 0x00000014 jne 00007FD448BF5D83h 0x0000001a neg ch 0x0000001c jmp 00007FD448BF546Fh 0x00000021 pushad 0x00000022 xchg eax, esi 0x00000023 sub esp, 0Fh 0x00000026 jbe 00007FD448BF5511h 0x0000002c xchg word ptr [esp+06h], ax 0x00000031 mov dx, 2507h 0x00000035 lea esp, dword ptr [esp+03h] 0x00000039 mov dword ptr [esp+24h], edi 0x0000003d lea esp, dword ptr [esp+0Ch] 0x00000041 jmp 00007FD448BF4F9Fh 0x00000046 popad 0x00000047 mov dword ptr [ecx], edx 0x00000049 jmp 00007FD448BF54C5h 0x0000004e rcr ch, cl 0x00000050 jbe 00007FD448BF5578h 0x00000052 setno ch 0x00000055 jmp 00007FD448BF55D0h 0x00000057 mov edx, edi 0x00000059 add edx, 04h 0x0000005c jnl 00007FD448BF5563h 0x0000005e jmp 00007FD448BF557Ah 0x00000060 mov dword ptr [edx], eax 0x00000062 bsf eax, ebp 0x00000065 call 00007FD448BF55A3h 0x0000006a pop word ptr [esp] 0x0000006e lea esp, dword ptr [esp+02h] 0x00000072 call 00007FD448BF5596h 0x00000077 jmp 00007FD448BF55CCh 0x00000079 shl eax, 03h 0x0000007c lea edx, dword ptr [00000000h+ebp*4] 0x00000083 inc cx 0x00000085 lea ecx, dword ptr [eax+edi] 0x00000088 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C899ED1 second address: 000000006C899EEE instructions: 0x00000000 rdtsc 0x00000002 xchg dword ptr [esp], ebx 0x00000005 jmp 00007FD448BFA0A2h 0x00000007 not ah 0x00000009 mov eax, DB0AC25Ah 0x0000000e mov edx, F128A53Ch 0x00000013 pushfd 0x00000014 jmp 00007FD448BFA107h 0x00000016 lea ebx, dword ptr [ebx-00044E40h] 0x0000001c mov dx, word ptr [esp] 0x00000020 mov dh, cl 0x00000022 neg dx 0x00000025 jmp 00007FD448BFA123h 0x00000027 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C899EEE second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 btc eax, esp 0x00000005 xchg dword ptr [esp+04h], ebx 0x00000009 mov cx, 5D6Fh 0x0000000d xchg cx, ax 0x00000010 sub esp, 1Eh 0x00000013 jmp 00007FD448BF5567h 0x00000015 mov dl, bl 0x00000017 not cx 0x0000001a lea esp, dword ptr [esp+02h] 0x0000001e push dword ptr [esp+20h] 0x00000022 retn 0024h 0x00000025 jmp 00007FD448BF55D8h 0x00000027 stc 0x00000028 jnle 00007FD448BF5549h 0x0000002a bsf cx, di 0x0000002e rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C882D5E second address: 000000006C882CA4 instructions: 0x00000000 rdtsc 0x00000002 mov ax, sp 0x00000005 jmp 00007FD448BFA02Eh 0x0000000a lea eax, dword ptr [edi+edi] 0x0000000d rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C882CA4 second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BC4133h 0x00000007 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C88B6DE second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 mov word ptr [edi], cx 0x00000005 bswap eax 0x00000007 setb al 0x0000000a inc cx 0x0000000c jmp 00007FD448BFA121h 0x0000000e jne 00007FD448BFA0C5h 0x00000010 jmp 00007FD448BC3A45h 0x00000015 jmp 00007FD448BFA138h 0x00000017 stc 0x00000018 jnle 00007FD448BFA0A9h 0x0000001a bsf cx, di 0x0000001e rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C8534C3 second address: 000000006C85353D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BF55C8h 0x00000004 push ebp 0x00000005 call 00007FD448BF5573h 0x0000000a push esp 0x0000000b mov esi, dword ptr [esp+03h] 0x0000000f bswap eax 0x00000011 mov byte ptr [esp+01h], cl 0x00000015 mov word ptr [esp+01h], sp 0x0000001a jmp 00007FD448BF55B9h 0x0000001c xchg dword ptr [esp+04h], ebp 0x00000020 pushad 0x00000021 inc cx 0x00000023 bsf di, bx 0x00000027 pop esi 0x00000028 clc 0x00000029 jmp 00007FD448BF556Dh 0x0000002b lea ebp, dword ptr [ebp-0000003Ch] 0x00000031 mov cl, dl 0x00000033 bsr edi, ecx 0x00000036 cmc 0x00000037 cmc 0x00000038 jmp 00007FD448BF55DDh 0x0000003a xchg dword ptr [esp+20h], ebp 0x0000003e inc cl 0x00000040 cmc 0x00000041 setne dh 0x00000044 lea edi, dword ptr [ecx+ebp] 0x00000047 push dword ptr [esp+20h] 0x0000004b retn 0024h 0x0000004e bswap edx 0x00000050 jmp 00007FD448BF5604h 0x00000052 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C88EFCD second address: 000000006C84EEEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD448BFA0D7h 0x00000008 sub esi, 08h 0x0000000b pushfd 0x0000000c jmp 00007FD448BFA137h 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 lea esp, dword ptr [esp+02h] 0x00000016 xchg edx, ecx 0x00000018 call 00007FD448BFA0D0h 0x0000001d add esp, 01h 0x00000020 jnle 00007FD448BFA128h 0x00000022 jmp 00007FD448BFA0DAh 0x00000024 lea esp, dword ptr [esp+03h] 0x00000028 jmp 00007FD448BFA104h 0x0000002a mov dword ptr [esi], ecx 0x0000002c mov ecx, edx 0x0000002e mov cx, word ptr [esp] 0x00000032 bsf ecx, ebx 0x00000035 jmp 00007FD448BFA13Fh 0x00000037 jnle 00007FD448BFA0A7h 0x00000039 mov cx, 166Ah 0x0000003d jmp 00007FD448BFA111h 0x0000003f mov dword ptr [esi+04h], eax 0x00000042 push dx 0x00000044 add esp, 01h 0x00000047 jmp 00007FD448BFA12Ah 0x00000049 jnle 00007FD448BFA0BCh 0x0000004b xchg byte ptr [esp], ah 0x0000004e lea esp, dword ptr [esp+01h] 0x00000052 jmp 00007FD448BB9F63h 0x00000057 mov cl, byte ptr [esp] 0x0000005a rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C884C1C second address: 000000006C884C48 instructions: 0x00000000 rdtsc 0x00000002 sub ebp, 02h 0x00000005 neg cx 0x00000008 js 00007FD448BF55ACh 0x0000000a add edx, 213E919Dh 0x00000010 mov edx, eax 0x00000012 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C89FABF second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 03h 0x00000005 jl 00007FD448BFA127h 0x00000007 mov word ptr [esp], sp 0x0000000b push word ptr [esp+02h] 0x00000010 sub esp, 16h 0x00000013 lea esp, dword ptr [esp+03h] 0x00000017 jmp 00007FD448BFA2AAh 0x0000001c sub esi, 08h 0x0000001f pushad 0x00000020 cmc 0x00000021 jl 00007FD448BF9FF2h 0x00000027 jnl 00007FD448BF9FECh 0x0000002d call 00007FD448BFA0D1h 0x00000032 pop dword ptr [esp+10h] 0x00000036 jmp 00007FD448BFA0D6h 0x00000038 xchg edx, ecx 0x0000003a clc 0x0000003b jnp 00007FD448BFA109h 0x0000003d jp 00007FD448BFA107h 0x0000003f mov dword ptr [esi], ecx 0x00000041 jmp 00007FD448BFA143h 0x00000043 mov ch, 19h 0x00000045 mov cx, 60D1h 0x00000049 lea ecx, dword ptr [00000000h+ebx*4] 0x00000050 bsr ecx, edi 0x00000053 jle 00007FD448BFA0BFh 0x00000055 jnle 00007FD448BFA0BDh 0x00000057 jmp 00007FD448BFA0DAh 0x00000059 mov ecx, esi 0x0000005b jmp 00007FD448BFA106h 0x0000005d add ecx, 04h 0x00000060 jmp 00007FD448BFA13Fh 0x00000062 jne 00007FD448BFA0A7h 0x00000064 mov dword ptr [ecx], eax 0x00000066 bswap eax 0x00000068 mov ecx, esi 0x0000006a jmp 00007FD448BABD76h 0x0000006f rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C862145 second address: 000000006C862238 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 jmp 00007FD448BF55C5h 0x00000006 xchg dword ptr [esp], ecx 0x00000009 mov al, 6Ah 0x0000000b ror ax, cl 0x0000000e setb dh 0x00000011 bsf eax, eax 0x00000014 lea edx, dword ptr [ecx-1DD4EFFBh] 0x0000001a jmp 00007FD448BF5566h 0x0000001c lea ecx, dword ptr [ecx-00000024h] 0x00000022 not edx 0x00000024 push edi 0x00000025 mov dx, word ptr [esp+03h] 0x0000002a jmp 00007FD448BF55E2h 0x0000002c xchg dword ptr [esp+04h], ecx 0x00000030 bswap edx 0x00000032 lea eax, dword ptr [00000000h+ecx*4] 0x00000039 mov ah, EDh 0x0000003b push dword ptr [esp+04h] 0x0000003f retn 0008h 0x00000042 stc 0x00000043 jbe 00007FD448BF561Ch 0x00000049 call 00007FD448BF57B3h 0x0000004e xchg edx, eax 0x00000050 mov eax, edi 0x00000052 mov dx, bp 0x00000055 push edi 0x00000056 xchg dword ptr [esp+04h], ecx 0x0000005a jmp 00007FD448BF53FDh 0x0000005f mov ah, 99h 0x00000061 sub esp, 01h 0x00000064 neg dx 0x00000067 mov byte ptr [esp], dh 0x0000006a cmc 0x0000006b lea esp, dword ptr [esp+01h] 0x0000006f jmp 00007FD448BF5562h 0x00000071 lea ecx, dword ptr [ecx+34h] 0x00000074 call 00007FD448BF5577h 0x00000079 mov word ptr [esp], ax 0x0000007d lea edx, dword ptr [edi+2Dh] 0x00000080 lea eax, dword ptr [00000000h+edx*4] 0x00000087 jmp 00007FD448BF55A0h 0x00000089 xchg dword ptr [esp+08h], ecx 0x0000008d mov al, bl 0x0000008f sub esp, 0Ah 0x00000092 mov dword ptr [esp+04h], esi 0x00000096 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C855094 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BFA0F6h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BFA0F6h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BFB1A5h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BFB27Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF9FF3h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BFA11Eh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BFA0D0h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BFA128h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BFA0CAh 0x00000057 dec ecx 0x00000058 jmp 00007FD448BAF70Dh 0x0000005d jmp 00007FD448BFA138h 0x0000005f stc 0x00000060 jnle 00007FD448BFA0A9h 0x00000062 bsf cx, di 0x00000066 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C889B34 second address: 000000006C889BA7 instructions: 0x00000000 rdtsc 0x00000002 ror eax, 0Bh 0x00000005 je 00007FD448BF5550h 0x00000007 bswap eax 0x00000009 mov ah, byte ptr [esp] 0x0000000c mov dx, bp 0x0000000f call 00007FD448BF5596h 0x00000014 mov edx, ebp 0x00000016 mov dh, ch 0x00000018 lea eax, dword ptr [ebp+ebp+00h] 0x0000001c sub esp, 19h 0x0000001f lea esp, dword ptr [esp+01h] 0x00000023 jmp 00007FD448BF55D5h 0x00000025 xchg dword ptr [esp+18h], esi 0x00000029 xchg edx, eax 0x0000002b mov dx, C92Fh 0x0000002f rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C89CF3F second address: 000000006C89CEDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFAC99h 0x00000007 mov dx, word ptr [esp] 0x0000000b push dword ptr [esp+04h] 0x0000000f retn 0008h 0x00000012 lea esp, dword ptr [esp+02h] 0x00000016 mov ecx, dword ptr [ebp+00h] 0x00000019 mov dx, 4C2Eh 0x0000001d jmp 00007FD448BFA0F7h 0x0000001f mov dh, byte ptr [esp] 0x00000022 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BF5596h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BF5596h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BF6645h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BF671Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF5493h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BF55BEh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BF5570h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BF55C8h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BF556Ah 0x00000057 dec ecx 0x00000058 jmp 00007FD448BAABADh 0x0000005d jmp 00007FD448BF55D8h 0x0000005f stc 0x00000060 jnle 00007FD448BF5549h 0x00000062 bsf cx, di 0x00000066 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88B7D0 second address: 000000006C88271D instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 js 00007FD448BFA1FFh 0x00000009 cmc 0x0000000a cmc 0x0000000b jmp 00007FD448BFA1A9h 0x00000010 sub ebp, 08h 0x00000013 pushad 0x00000014 pop word ptr [esp+05h] 0x00000019 jmp 00007FD448BFA07Ch 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f xchg edx, ecx 0x00000021 call 00007FD448BFA0D4h 0x00000026 mov word ptr [esp], si 0x0000002a pop word ptr [esp] 0x0000002e lea esp, dword ptr [esp+02h] 0x00000032 jmp 00007FD448BFA121h 0x00000034 mov dword ptr [ebp+00h], ecx 0x00000037 pushfd 0x00000038 neg cx 0x0000003b jnp 00007FD448BFA0CDh 0x0000003d mov cx, word ptr [esp+03h] 0x00000042 lea ecx, dword ptr [edx-000000F7h] 0x00000048 jmp 00007FD448BFA10Ch 0x0000004a mov dword ptr [ebp+04h], eax 0x0000004d mov ax, sp 0x00000050 mov ecx, dword ptr [esp] 0x00000053 jmp 00007FD448BF0EBAh 0x00000058 jmp 00007FD448BFA1DEh 0x0000005d xchg eax, ecx 0x0000005e rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88B7D0 second address: 000000006C88271D instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 js 00007FD448BF569Fh 0x00000009 cmc 0x0000000a cmc 0x0000000b jmp 00007FD448BF5649h 0x00000010 sub ebp, 08h 0x00000013 pushad 0x00000014 pop word ptr [esp+05h] 0x00000019 jmp 00007FD448BF551Ch 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f xchg edx, ecx 0x00000021 call 00007FD448BF5574h 0x00000026 mov word ptr [esp], si 0x0000002a pop word ptr [esp] 0x0000002e lea esp, dword ptr [esp+02h] 0x00000032 jmp 00007FD448BF55C1h 0x00000034 mov dword ptr [ebp+00h], ecx 0x00000037 pushfd 0x00000038 neg cx 0x0000003b jnp 00007FD448BF556Dh 0x0000003d jp 00007FD448BF55B0h 0x0000003f mov cx, word ptr [esp+03h] 0x00000044 lea ecx, dword ptr [edx-000000F7h] 0x0000004a jmp 00007FD448BF5567h 0x0000004c mov dword ptr [ebp+04h], eax 0x0000004f mov ax, sp 0x00000052 mov ecx, dword ptr [esp] 0x00000055 jmp 00007FD448BEC35Ah 0x0000005a jmp 00007FD448BF567Eh 0x0000005f xchg eax, ecx 0x00000060 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C89AF6D second address: 000000006C89AF32 instructions: 0x00000000 rdtsc 0x00000002 neg eax 0x00000004 jmp 00007FD448BFA08Fh 0x00000006 jc 00007FD448BFA10Fh 0x00000008 mov eax, dword ptr [esp] 0x0000000b rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C855094 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BF5596h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BF5596h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BF6645h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BF671Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF5493h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BF55BEh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BF5570h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BF55C8h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BF556Ah 0x00000057 dec ecx 0x00000058 jmp 00007FD448BAABADh 0x0000005d jmp 00007FD448BF55D8h 0x0000005f stc 0x00000060 jnle 00007FD448BF5549h 0x00000062 bsf cx, di 0x00000066 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BFA0F6h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BFA0F6h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BFB1A5h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BFB27Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF9FF3h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BFA11Eh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BFA0D0h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BFA128h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BFA0CAh 0x00000057 dec ecx 0x00000058 jmp 00007FD448BAF70Dh 0x0000005d jmp 00007FD448BFA138h 0x0000005f stc 0x00000060 jnle 00007FD448BFA0A9h 0x00000062 bsf cx, di 0x00000066 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88B7D0 second address: 000000006C88271D instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 js 00007FD448BF569Fh 0x00000009 cmc 0x0000000a cmc 0x0000000b jmp 00007FD448BF5649h 0x00000010 sub ebp, 08h 0x00000013 pushad 0x00000014 pop word ptr [esp+05h] 0x00000019 jmp 00007FD448BF551Ch 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f xchg edx, ecx 0x00000021 call 00007FD448BF5574h 0x00000026 mov word ptr [esp], si 0x0000002a pop word ptr [esp] 0x0000002e lea esp, dword ptr [esp+02h] 0x00000032 jmp 00007FD448BF55C1h 0x00000034 mov dword ptr [ebp+00h], ecx 0x00000037 pushfd 0x00000038 neg cx 0x0000003b jnp 00007FD448BF556Dh 0x0000003d mov cx, word ptr [esp+03h] 0x00000042 lea ecx, dword ptr [edx-000000F7h] 0x00000048 jmp 00007FD448BF55ACh 0x0000004a mov dword ptr [ebp+04h], eax 0x0000004d mov ax, sp 0x00000050 mov ecx, dword ptr [esp] 0x00000053 jmp 00007FD448BEC35Ah 0x00000058 jmp 00007FD448BF567Eh 0x0000005d xchg eax, ecx 0x0000005e rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C855094 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BFA0F6h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BFA0F6h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BFB1A5h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BFB27Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF9FF3h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BFA11Eh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BFA0D0h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BFA128h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BFA0CAh 0x00000057 dec ecx 0x00000058 jmp 00007FD448BAF70Dh 0x0000005d jmp 00007FD448BFA138h 0x0000005f stc 0x00000060 jnle 00007FD448BFA0A9h 0x00000062 bsf cx, di 0x00000066 rdtsc
            Source: C:\Windows\System32\loaddll32.exeRDTSC instruction interceptor: First address: 000000006C88B7D0 second address: 000000006C88271D instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 js 00007FD448BFA1FFh 0x00000009 cmc 0x0000000a cmc 0x0000000b jmp 00007FD448BFA1A9h 0x00000010 sub ebp, 08h 0x00000013 pushad 0x00000014 pop word ptr [esp+05h] 0x00000019 jmp 00007FD448BFA07Ch 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f xchg edx, ecx 0x00000021 call 00007FD448BFA0D4h 0x00000026 mov word ptr [esp], si 0x0000002a pop word ptr [esp] 0x0000002e lea esp, dword ptr [esp+02h] 0x00000032 jmp 00007FD448BFA121h 0x00000034 mov dword ptr [ebp+00h], ecx 0x00000037 pushfd 0x00000038 neg cx 0x0000003b jnp 00007FD448BFA0CDh 0x0000003d jp 00007FD448BFA110h 0x0000003f mov cx, word ptr [esp+03h] 0x00000044 lea ecx, dword ptr [edx-000000F7h] 0x0000004a jmp 00007FD448BFA0C7h 0x0000004c mov dword ptr [ebp+04h], eax 0x0000004f mov ax, sp 0x00000052 mov ecx, dword ptr [esp] 0x00000055 jmp 00007FD448BF0EBAh 0x0000005a jmp 00007FD448BFA1DEh 0x0000005f xchg eax, ecx 0x00000060 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C84B85B second address: 000000006C84B903 instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [eax+ebx] 0x00000005 jmp 00007FD448BF556Fh 0x00000007 cmp eax, 9DA45E12h 0x0000000c push si 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 jmp 00007FD448BF55BEh 0x00000014 pop esi 0x00000015 mov al, dl 0x00000017 mov al, dl 0x00000019 clc 0x0000001a jnp 00007FD448BF5574h 0x0000001c jp 00007FD448BF5606h 0x0000001e pop ebp 0x0000001f mov ch, 2Fh 0x00000021 mov ax, BE00h 0x00000025 or eax, ebx 0x00000027 jnle 00007FD448BF5551h 0x00000029 jle 00007FD448BF5539h 0x0000002b add esp, 04h 0x0000002e jnbe 00007FD448BF55BBh 0x00000030 pushfd 0x00000031 mov cx, word ptr [esp+02h] 0x00000036 jmp 00007FD448BF5574h 0x00000038 lea edi, dword ptr [ecx+ebx] 0x0000003b mov edi, dword ptr [esp+04h] 0x0000003f mov edx, 6C4C3A78h 0x00000044 push dx 0x00000046 jmp 00007FD448BF55A0h 0x00000048 lea esp, dword ptr [esp+02h] 0x0000004c lea esp, dword ptr [esp+08h] 0x00000050 call 00007FD448BF55C1h 0x00000055 mov ax, dx 0x00000058 mov cl, B9h 0x0000005a bt dx, bx 0x0000005e xchg dword ptr [esp], ecx 0x00000061 jmp 00007FD448BF556Eh 0x00000063 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C83CBE2 second address: 000000006C83CCAF instructions: 0x00000000 rdtsc 0x00000002 xchg ecx, edx 0x00000004 mov ax, word ptr [esp] 0x00000008 mov edx, B68AAC39h 0x0000000d lea esi, dword ptr [esi-00000052h] 0x00000013 xchg eax, edx 0x00000014 jmp 00007FD448BFA113h 0x00000016 mov edx, ecx 0x00000018 lea eax, dword ptr [00000000h+edi*4] 0x0000001f mov dx, 208Bh 0x00000023 xchg dword ptr [esp+20h], esi 0x00000027 mov cl, ch 0x00000029 xchg dx, ax 0x0000002c jmp 00007FD448BFA0C3h 0x0000002e xchg dx, ax 0x00000031 mov ecx, dword ptr [esp] 0x00000034 push dword ptr [esp+20h] 0x00000038 retn 0024h 0x0000003b mov eax, 12F33EA2h 0x00000040 xor cl, 00000044h 0x00000043 jnl 00007FD448BFA1D0h 0x00000049 pushfd 0x0000004a mov dx, cx 0x0000004d mov dh, 56h 0x0000004f lea eax, dword ptr [ebx-03h] 0x00000052 lea ecx, dword ptr [ecx-0F5291AAh] 0x00000058 lea esp, dword ptr [esp+04h] 0x0000005c sub ebp, 1284C013h 0x00000062 call 00007FD448BFA10Ch 0x00000067 mov ecx, dword ptr [esp] 0x0000006a rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C882D5E second address: 000000006C882CA4 instructions: 0x00000000 rdtsc 0x00000002 mov ax, sp 0x00000005 jmp 00007FD448BF54CEh 0x0000000a lea eax, dword ptr [edi+edi] 0x0000000d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C882CA4 second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BC8C93h 0x00000007 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88B6DE second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 mov word ptr [edi], cx 0x00000005 bswap eax 0x00000007 setb al 0x0000000a inc cx 0x0000000c jmp 00007FD448BF55C1h 0x0000000e jne 00007FD448BF5565h 0x00000010 jmp 00007FD448BBEEE5h 0x00000015 jmp 00007FD448BF55D8h 0x00000017 stc 0x00000018 jnle 00007FD448BF5549h 0x0000001a bsf cx, di 0x0000001e rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C8534C3 second address: 000000006C85353D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD448BFA128h 0x00000004 push ebp 0x00000005 call 00007FD448BFA0D3h 0x0000000a push esp 0x0000000b mov esi, dword ptr [esp+03h] 0x0000000f bswap eax 0x00000011 mov byte ptr [esp+01h], cl 0x00000015 mov word ptr [esp+01h], sp 0x0000001a jmp 00007FD448BFA119h 0x0000001c xchg dword ptr [esp+04h], ebp 0x00000020 pushad 0x00000021 inc cx 0x00000023 bsf di, bx 0x00000027 pop esi 0x00000028 clc 0x00000029 jmp 00007FD448BFA0CDh 0x0000002b lea ebp, dword ptr [ebp-0000003Ch] 0x00000031 mov cl, dl 0x00000033 bsr edi, ecx 0x00000036 cmc 0x00000037 cmc 0x00000038 jmp 00007FD448BFA13Dh 0x0000003a xchg dword ptr [esp+20h], ebp 0x0000003e inc cl 0x00000040 cmc 0x00000041 setne dh 0x00000044 lea edi, dword ptr [ecx+ebp] 0x00000047 push dword ptr [esp+20h] 0x0000004b retn 0024h 0x0000004e bswap edx 0x00000050 jmp 00007FD448BFA164h 0x00000052 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88EFCD second address: 000000006C84EEEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD448BF5577h 0x00000008 sub esi, 08h 0x0000000b pushfd 0x0000000c jmp 00007FD448BF55D7h 0x0000000e lea esp, dword ptr [esp+02h] 0x00000012 lea esp, dword ptr [esp+02h] 0x00000016 xchg edx, ecx 0x00000018 call 00007FD448BF5570h 0x0000001d add esp, 01h 0x00000020 jnle 00007FD448BF55C8h 0x00000022 jmp 00007FD448BF557Ah 0x00000024 lea esp, dword ptr [esp+03h] 0x00000028 jmp 00007FD448BF55A4h 0x0000002a mov dword ptr [esi], ecx 0x0000002c mov ecx, edx 0x0000002e mov cx, word ptr [esp] 0x00000032 bsf ecx, ebx 0x00000035 jmp 00007FD448BF55DFh 0x00000037 jnle 00007FD448BF5547h 0x00000039 mov cx, 166Ah 0x0000003d jmp 00007FD448BF55B1h 0x0000003f mov dword ptr [esi+04h], eax 0x00000042 push dx 0x00000044 add esp, 01h 0x00000047 jmp 00007FD448BF55CAh 0x00000049 jnle 00007FD448BF555Ch 0x0000004b xchg byte ptr [esp], ah 0x0000004e lea esp, dword ptr [esp+01h] 0x00000052 jmp 00007FD448BB5403h 0x00000057 mov cl, byte ptr [esp] 0x0000005a rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C884C1C second address: 000000006C884C48 instructions: 0x00000000 rdtsc 0x00000002 sub ebp, 02h 0x00000005 neg cx 0x00000008 js 00007FD448BFA10Ch 0x0000000a add edx, 213E919Dh 0x00000010 mov edx, eax 0x00000012 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89FABF second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 03h 0x00000005 jl 00007FD448BF55C7h 0x00000007 mov word ptr [esp], sp 0x0000000b push word ptr [esp+02h] 0x00000010 sub esp, 16h 0x00000013 lea esp, dword ptr [esp+03h] 0x00000017 jmp 00007FD448BF574Ah 0x0000001c sub esi, 08h 0x0000001f pushad 0x00000020 cmc 0x00000021 jl 00007FD448BF5492h 0x00000027 jnl 00007FD448BF548Ch 0x0000002d call 00007FD448BF5571h 0x00000032 pop dword ptr [esp+10h] 0x00000036 jmp 00007FD448BF5576h 0x00000038 xchg edx, ecx 0x0000003a clc 0x0000003b jnp 00007FD448BF55A9h 0x0000003d jp 00007FD448BF55A7h 0x0000003f mov dword ptr [esi], ecx 0x00000041 jmp 00007FD448BF55E3h 0x00000043 mov ch, 19h 0x00000045 mov cx, 60D1h 0x00000049 lea ecx, dword ptr [00000000h+ebx*4] 0x00000050 bsr ecx, edi 0x00000053 jle 00007FD448BF555Fh 0x00000055 jnle 00007FD448BF555Dh 0x00000057 jmp 00007FD448BF557Ah 0x00000059 mov ecx, esi 0x0000005b jmp 00007FD448BF55A6h 0x0000005d add ecx, 04h 0x00000060 jmp 00007FD448BF55DFh 0x00000062 jne 00007FD448BF5547h 0x00000064 mov dword ptr [ecx], eax 0x00000066 bswap eax 0x00000068 mov ecx, esi 0x0000006a jmp 00007FD448BA7216h 0x0000006f rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C862145 second address: 000000006C862238 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 jmp 00007FD448BFA125h 0x00000006 xchg dword ptr [esp], ecx 0x00000009 mov al, 6Ah 0x0000000b ror ax, cl 0x0000000e setb dh 0x00000011 bsf eax, eax 0x00000014 lea edx, dword ptr [ecx-1DD4EFFBh] 0x0000001a jmp 00007FD448BFA0C6h 0x0000001c lea ecx, dword ptr [ecx-00000024h] 0x00000022 not edx 0x00000024 push edi 0x00000025 mov dx, word ptr [esp+03h] 0x0000002a jmp 00007FD448BFA142h 0x0000002c xchg dword ptr [esp+04h], ecx 0x00000030 bswap edx 0x00000032 lea eax, dword ptr [00000000h+ecx*4] 0x00000039 mov ah, EDh 0x0000003b push dword ptr [esp+04h] 0x0000003f retn 0008h 0x00000042 stc 0x00000043 jbe 00007FD448BFA17Ch 0x00000049 call 00007FD448BFA313h 0x0000004e xchg edx, eax 0x00000050 mov eax, edi 0x00000052 mov dx, bp 0x00000055 push edi 0x00000056 xchg dword ptr [esp+04h], ecx 0x0000005a jmp 00007FD448BF9F5Dh 0x0000005f mov ah, 99h 0x00000061 sub esp, 01h 0x00000064 neg dx 0x00000067 mov byte ptr [esp], dh 0x0000006a cmc 0x0000006b lea esp, dword ptr [esp+01h] 0x0000006f jmp 00007FD448BFA0C2h 0x00000071 lea ecx, dword ptr [ecx+34h] 0x00000074 call 00007FD448BFA0D7h 0x00000079 mov word ptr [esp], ax 0x0000007d lea edx, dword ptr [edi+2Dh] 0x00000080 lea eax, dword ptr [00000000h+edx*4] 0x00000087 jmp 00007FD448BFA100h 0x00000089 xchg dword ptr [esp+08h], ecx 0x0000008d mov al, bl 0x0000008f sub esp, 0Ah 0x00000092 mov dword ptr [esp+04h], esi 0x00000096 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C899DB9 second address: 000000006C899ED1 instructions: 0x00000000 rdtsc 0x00000002 setnle cl 0x00000005 setb cl 0x00000008 jmp 00007FD448BFA141h 0x0000000a sub edi, 08h 0x0000000d xchg ch, cl 0x0000000f bsr ecx, ebx 0x00000012 je 00007FD448BFA0D2h 0x00000014 jne 00007FD448BFA8E3h 0x0000001a neg ch 0x0000001c jmp 00007FD448BF9FCFh 0x00000021 pushad 0x00000022 xchg eax, esi 0x00000023 sub esp, 0Fh 0x00000026 jbe 00007FD448BFA071h 0x0000002c xchg word ptr [esp+06h], ax 0x00000031 mov dx, 2507h 0x00000035 lea esp, dword ptr [esp+03h] 0x00000039 mov dword ptr [esp+24h], edi 0x0000003d lea esp, dword ptr [esp+0Ch] 0x00000041 jmp 00007FD448BF9AFFh 0x00000046 popad 0x00000047 mov dword ptr [ecx], edx 0x00000049 jmp 00007FD448BFA025h 0x0000004e rcr ch, cl 0x00000050 jbe 00007FD448BFA0D8h 0x00000052 setno ch 0x00000055 jmp 00007FD448BFA130h 0x00000057 mov edx, edi 0x00000059 add edx, 04h 0x0000005c jnl 00007FD448BFA0C3h 0x0000005e jmp 00007FD448BFA0DAh 0x00000060 mov dword ptr [edx], eax 0x00000062 bsf eax, ebp 0x00000065 call 00007FD448BFA103h 0x0000006a pop word ptr [esp] 0x0000006e lea esp, dword ptr [esp+02h] 0x00000072 call 00007FD448BFA0F6h 0x00000077 jmp 00007FD448BFA12Ch 0x00000079 shl eax, 03h 0x0000007c lea edx, dword ptr [00000000h+ebp*4] 0x00000083 inc cx 0x00000085 lea ecx, dword ptr [eax+edi] 0x00000088 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89FABF second address: 000000006C851849 instructions: 0x00000000 rdtsc 0x00000002 sub esp, 03h 0x00000005 jl 00007FD448BF55C7h 0x00000007 mov word ptr [esp], sp 0x0000000b push word ptr [esp+02h] 0x00000010 sub esp, 16h 0x00000013 lea esp, dword ptr [esp+03h] 0x00000017 jmp 00007FD448BF574Ah 0x0000001c sub esi, 08h 0x0000001f pushad 0x00000020 cmc 0x00000021 jl 00007FD448BF5492h 0x00000027 jnl 00007FD448BF548Ch 0x0000002d call 00007FD448BF5571h 0x00000032 pop dword ptr [esp+10h] 0x00000036 jmp 00007FD448BF5576h 0x00000038 xchg edx, ecx 0x0000003a clc 0x0000003b jnp 00007FD448BF55A9h 0x0000003d mov dword ptr [esi], ecx 0x0000003f jmp 00007FD448BF55E3h 0x00000041 mov ch, 19h 0x00000043 mov cx, 60D1h 0x00000047 lea ecx, dword ptr [00000000h+ebx*4] 0x0000004e bsr ecx, edi 0x00000051 jle 00007FD448BF555Fh 0x00000053 jnle 00007FD448BF555Dh 0x00000055 jmp 00007FD448BF557Ah 0x00000057 mov ecx, esi 0x00000059 jmp 00007FD448BF55A6h 0x0000005b add ecx, 04h 0x0000005e jmp 00007FD448BF55DFh 0x00000060 jne 00007FD448BF5547h 0x00000062 mov dword ptr [ecx], eax 0x00000064 bswap eax 0x00000066 mov ecx, esi 0x00000068 jmp 00007FD448BA7216h 0x0000006d rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C85504B instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BFA0F6h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BFA0F6h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BFB1A5h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BFB27Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF9FF3h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BFA11Eh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BFA0D0h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BFA128h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BFA0CAh 0x00000057 jnp 00007FD448BFA0CFh 0x00000059 dec ecx 0x0000005a jmp 00007FD448BAF706h 0x0000005f jmp 00007FD448BFA138h 0x00000061 stc 0x00000062 jnle 00007FD448BFA0A9h 0x00000064 bsf cx, di 0x00000068 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C855094 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BF5596h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BF5596h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BF6645h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BF671Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF5493h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BF55BEh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BF5570h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BF55C8h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BF556Ah 0x00000057 jnp 00007FD448BF556Fh 0x00000059 dec ecx 0x0000005a jmp 00007FD448BAABA6h 0x0000005f jmp 00007FD448BF55D8h 0x00000061 stc 0x00000062 jnle 00007FD448BF5549h 0x00000064 bsf cx, di 0x00000068 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C89E930 second address: 000000006C855094 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD448BFA0F6h 0x00000007 sub edi, 08h 0x0000000a jmp 00007FD448BFA0F6h 0x0000000c pushad 0x0000000d lea esp, dword ptr [esp+01h] 0x00000011 add esp, 16h 0x00000014 jo 00007FD448BFB1A5h 0x0000001a pop dword ptr [esp] 0x0000001d jmp 00007FD448BFB27Ah 0x00000022 lea esp, dword ptr [esp+01h] 0x00000026 jmp 00007FD448BF9FF3h 0x0000002b mov dword ptr [edi], edx 0x0000002d mov dx, cx 0x00000030 setp dh 0x00000033 mov edx, ebx 0x00000035 jmp 00007FD448BFA11Eh 0x00000037 xchg eax, ecx 0x00000038 mov dx, word ptr [esp] 0x0000003c bt edx, edx 0x0000003f jnl 00007FD448BFA0D0h 0x00000041 bt edx, esi 0x00000044 lea edx, dword ptr [00000000h+ebx*4] 0x0000004b jmp 00007FD448BFA128h 0x0000004d mov dword ptr [edi+04h], ecx 0x00000050 bswap ecx 0x00000052 rol cl, 00000006h 0x00000055 jp 00007FD448BFA0CAh 0x00000057 jnp 00007FD448BFA0CFh 0x00000059 dec ecx 0x0000005a jmp 00007FD448BAF706h 0x0000005f jmp 00007FD448BFA138h 0x00000061 stc 0x00000062 jnle 00007FD448BFA0A9h 0x00000064 bsf cx, di 0x00000068 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 000000006C88B7D0 second address: 000000006C88271D instructions: 0x00000000 rdtsc 0x00000002 clc 0x00000003 js 00007FD448BFA1FFh 0x00000009 cmc 0x0000000a cmc 0x0000000b jmp 00007FD448BFA1A9h 0x00000010 sub ebp, 08h 0x00000013 pushad 0x00000014 pop word ptr [esp+05h] 0x00000019 jmp 00007FD448BFA07Ch 0x0000001b lea esp, dword ptr [esp+02h] 0x0000001f xchg edx, ecx 0x00000021 call 00007FD448BFA0D4h 0x00000026 mov word ptr [esp], si 0x0000002a pop word ptr [esp] 0x0000002e lea esp, dword ptr [esp+02h] 0x00000032 jmp 00007FD448BFA121h 0x00000034 mov dword ptr [ebp+00h], ecx 0x00000037 pushfd 0x00000038 neg cx 0x0000003b jnp 00007FD448BFA0CDh 0x0000003d jp 00007FD448BFA110h 0x0000003f mov cx, word ptr [esp+03h] 0x00000044 lea ecx, dword ptr [edx-000000F7h] 0x0000004a jmp 00007FD448BFA0C7h 0x0000004c mov dword ptr [ebp+04h], eax 0x0000004f mov ax, sp 0x00000052 mov ecx, dword ptr [esp] 0x00000055 jmp 00007FD448BF0EBAh 0x0000005a jmp 00007FD448BFA1DEh 0x0000005f xchg eax, ecx 0x00000060 rdtsc
            Source: C:\Windows\SysWOW64\rundll32.exe TID: 7604Thread sleep time: -36000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exe TID: 7296Thread sleep time: -40000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exe TID: 7564Thread sleep time: -32000s >= -30000sJump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
            Source: rundll32.exe, 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: DisableGuestVmNetworkConnectivity
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWf
            Source: rundll32.exe, 00000003.00000002.761369854.000000000098D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: rundll32.exe, 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: EnableGuestVmNetworkConnectivity
            Source: rundll32.exe, 00000003.00000002.761369854.000000000092D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW

            Anti Debugging

            barindex
            Hides threads from debuggers
            Source: C:\Windows\System32\loaddll32.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebugger
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebugger
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebugger
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebugger
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebugger
            Source: C:\Windows\SysWOW64\rundll32.exeThread information set: HideFromDebugger
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57ABA mov eax, dword ptr fs:[00000030h]0_2_02A57ABA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57ABA mov eax, dword ptr fs:[00000030h]0_2_02A57ABA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5D2EB mov eax, dword ptr fs:[00000030h]0_2_02A5D2EB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02AA42F0 mov eax, dword ptr fs:[00000030h]0_2_02AA42F0
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A782F8 mov eax, dword ptr fs:[00000030h]0_2_02A782F8
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A782F8 mov eax, dword ptr fs:[00000030h]0_2_02A782F8
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A48AC4 mov eax, dword ptr fs:[00000030h]0_2_02A48AC4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8E2C6 mov eax, dword ptr fs:[00000030h]0_2_02A8E2C6
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8D21B mov eax, dword ptr fs:[00000030h]0_2_02A8D21B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8D21B mov eax, dword ptr fs:[00000030h]0_2_02A8D21B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8D21B mov eax, dword ptr fs:[00000030h]0_2_02A8D21B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8D21B mov eax, dword ptr fs:[00000030h]0_2_02A8D21B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8D21B mov ecx, dword ptr fs:[00000030h]0_2_02A8D21B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A76210 mov eax, dword ptr fs:[00000030h]0_2_02A76210
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A87A4E mov eax, dword ptr fs:[00000030h]0_2_02A87A4E
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A87A4E mov ecx, dword ptr fs:[00000030h]0_2_02A87A4E
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58250 mov eax, dword ptr fs:[00000030h]0_2_02A58250
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58250 mov eax, dword ptr fs:[00000030h]0_2_02A58250
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58250 mov eax, dword ptr fs:[00000030h]0_2_02A58250
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57A52 mov eax, dword ptr fs:[00000030h]0_2_02A57A52
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57A52 mov eax, dword ptr fs:[00000030h]0_2_02A57A52
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57A52 mov eax, dword ptr fs:[00000030h]0_2_02A57A52
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57A52 mov eax, dword ptr fs:[00000030h]0_2_02A57A52
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A46B94 mov ecx, dword ptr fs:[00000030h]0_2_02A46B94
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57394 mov eax, dword ptr fs:[00000030h]0_2_02A57394
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57394 mov eax, dword ptr fs:[00000030h]0_2_02A57394
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57394 mov eax, dword ptr fs:[00000030h]0_2_02A57394
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A57394 mov eax, dword ptr fs:[00000030h]0_2_02A57394
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A593E3 mov ecx, dword ptr fs:[00000030h]0_2_02A593E3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A593E3 mov eax, dword ptr fs:[00000030h]0_2_02A593E3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A97BE4 mov eax, dword ptr fs:[00000030h]0_2_02A97BE4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A97BE4 mov ecx, dword ptr fs:[00000030h]0_2_02A97BE4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A97BE4 mov ecx, dword ptr fs:[00000030h]0_2_02A97BE4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5E3F3 mov eax, dword ptr fs:[00000030h]0_2_02A5E3F3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5E3F3 mov eax, dword ptr fs:[00000030h]0_2_02A5E3F3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5E3F3 mov eax, dword ptr fs:[00000030h]0_2_02A5E3F3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55BC8 mov eax, dword ptr fs:[00000030h]0_2_02A55BC8
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55BC8 mov eax, dword ptr fs:[00000030h]0_2_02A55BC8
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58BDB mov eax, dword ptr fs:[00000030h]0_2_02A58BDB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58BDB mov eax, dword ptr fs:[00000030h]0_2_02A58BDB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55B14 mov eax, dword ptr fs:[00000030h]0_2_02A55B14
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55B14 mov eax, dword ptr fs:[00000030h]0_2_02A55B14
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5D344 mov eax, dword ptr fs:[00000030h]0_2_02A5D344
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5D344 mov eax, dword ptr fs:[00000030h]0_2_02A5D344
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5D344 mov eax, dword ptr fs:[00000030h]0_2_02A5D344
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7F344 mov eax, dword ptr fs:[00000030h]0_2_02A7F344
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7F344 mov eax, dword ptr fs:[00000030h]0_2_02A7F344
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A94B4A mov eax, dword ptr fs:[00000030h]0_2_02A94B4A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A94B4A mov ecx, dword ptr fs:[00000030h]0_2_02A94B4A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A76342 mov eax, dword ptr fs:[00000030h]0_2_02A76342
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A578B4 mov eax, dword ptr fs:[00000030h]0_2_02A578B4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A578B4 mov eax, dword ptr fs:[00000030h]0_2_02A578B4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A578B4 mov eax, dword ptr fs:[00000030h]0_2_02A578B4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A578B4 mov eax, dword ptr fs:[00000030h]0_2_02A578B4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5E082 mov eax, dword ptr fs:[00000030h]0_2_02A5E082
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5E082 mov eax, dword ptr fs:[00000030h]0_2_02A5E082
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8D0EF mov eax, dword ptr fs:[00000030h]0_2_02A8D0EF
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8D0EF mov ecx, dword ptr fs:[00000030h]0_2_02A8D0EF
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A460CC mov ebx, dword ptr fs:[00000030h]0_2_02A460CC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A460CC mov eax, dword ptr fs:[00000030h]0_2_02A460CC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A460CC mov ecx, dword ptr fs:[00000030h]0_2_02A460CC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A460CC mov eax, dword ptr fs:[00000030h]0_2_02A460CC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A778D4 cmp dword ptr fs:[00000030h], ebx0_2_02A778D4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A778D4 mov eax, dword ptr fs:[00000030h]0_2_02A778D4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A778D4 mov eax, dword ptr fs:[00000030h]0_2_02A778D4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A778D4 mov eax, dword ptr fs:[00000030h]0_2_02A778D4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A768DC mov eax, dword ptr fs:[00000030h]0_2_02A768DC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A768DC mov eax, dword ptr fs:[00000030h]0_2_02A768DC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A76838 mov ecx, dword ptr fs:[00000030h]0_2_02A76838
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8206A mov eax, dword ptr fs:[00000030h]0_2_02A8206A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8206A mov ecx, dword ptr fs:[00000030h]0_2_02A8206A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A479A4 mov eax, dword ptr fs:[00000030h]0_2_02A479A4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A479A4 mov eax, dword ptr fs:[00000030h]0_2_02A479A4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A479A4 mov eax, dword ptr fs:[00000030h]0_2_02A479A4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A769B2 mov eax, dword ptr fs:[00000030h]0_2_02A769B2
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A769B2 mov ecx, dword ptr fs:[00000030h]0_2_02A769B2
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55994 mov eax, dword ptr fs:[00000030h]0_2_02A55994
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55994 mov eax, dword ptr fs:[00000030h]0_2_02A55994
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4E9E4 mov eax, dword ptr fs:[00000030h]0_2_02A4E9E4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8E1EA mov eax, dword ptr fs:[00000030h]0_2_02A8E1EA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8E1EA mov ecx, dword ptr fs:[00000030h]0_2_02A8E1EA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8E1EA mov eax, dword ptr fs:[00000030h]0_2_02A8E1EA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A971EE mov eax, dword ptr fs:[00000030h]0_2_02A971EE
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A971EE mov ecx, dword ptr fs:[00000030h]0_2_02A971EE
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A971EE mov ecx, dword ptr fs:[00000030h]0_2_02A971EE
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A81121 mov eax, dword ptr fs:[00000030h]0_2_02A81121
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A81121 mov eax, dword ptr fs:[00000030h]0_2_02A81121
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8194A mov eax, dword ptr fs:[00000030h]0_2_02A8194A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02AA4146 mov eax, dword ptr fs:[00000030h]0_2_02AA4146
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A95E8A mov eax, dword ptr fs:[00000030h]0_2_02A95E8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A95E8A mov eax, dword ptr fs:[00000030h]0_2_02A95E8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A95E8A mov eax, dword ptr fs:[00000030h]0_2_02A95E8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A95E8A mov ecx, dword ptr fs:[00000030h]0_2_02A95E8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A95E8A mov eax, dword ptr fs:[00000030h]0_2_02A95E8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A95E8A mov ecx, dword ptr fs:[00000030h]0_2_02A95E8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A97E8C mov ecx, dword ptr fs:[00000030h]0_2_02A97E8C
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A97E8C mov ecx, dword ptr fs:[00000030h]0_2_02A97E8C
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58EE3 mov eax, dword ptr fs:[00000030h]0_2_02A58EE3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58EE3 mov eax, dword ptr fs:[00000030h]0_2_02A58EE3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58EE3 mov ecx, dword ptr fs:[00000030h]0_2_02A58EE3
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4CED4 mov eax, dword ptr fs:[00000030h]0_2_02A4CED4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4CED4 mov ecx, dword ptr fs:[00000030h]0_2_02A4CED4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96637 mov eax, dword ptr fs:[00000030h]0_2_02A96637
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96637 mov eax, dword ptr fs:[00000030h]0_2_02A96637
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96637 mov eax, dword ptr fs:[00000030h]0_2_02A96637
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96637 mov eax, dword ptr fs:[00000030h]0_2_02A96637
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96637 mov eax, dword ptr fs:[00000030h]0_2_02A96637
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96637 mov ecx, dword ptr fs:[00000030h]0_2_02A96637
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96E47 mov eax, dword ptr fs:[00000030h]0_2_02A96E47
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FE58 mov ecx, dword ptr fs:[00000030h]0_2_02A4FE58
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FE58 mov eax, dword ptr fs:[00000030h]0_2_02A4FE58
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A95FB9 mov eax, dword ptr fs:[00000030h]0_2_02A95FB9
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02AA3FB4 mov eax, dword ptr fs:[00000030h]0_2_02AA3FB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02AA3FB4 mov eax, dword ptr fs:[00000030h]0_2_02AA3FB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02AA3FB4 mov eax, dword ptr fs:[00000030h]0_2_02AA3FB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02AA3FB4 mov eax, dword ptr fs:[00000030h]0_2_02AA3FB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A50FBB mov eax, dword ptr fs:[00000030h]0_2_02A50FBB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A50FBB mov eax, dword ptr fs:[00000030h]0_2_02A50FBB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A50FBB mov eax, dword ptr fs:[00000030h]0_2_02A50FBB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A50FBB mov eax, dword ptr fs:[00000030h]0_2_02A50FBB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A50FBB mov eax, dword ptr fs:[00000030h]0_2_02A50FBB
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5CFF4 mov eax, dword ptr fs:[00000030h]0_2_02A5CFF4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96FD7 mov eax, dword ptr fs:[00000030h]0_2_02A96FD7
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96FD7 mov ecx, dword ptr fs:[00000030h]0_2_02A96FD7
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A96FD7 mov ecx, dword ptr fs:[00000030h]0_2_02A96FD7
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7FF23 mov eax, dword ptr fs:[00000030h]0_2_02A7FF23
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7FF23 mov eax, dword ptr fs:[00000030h]0_2_02A7FF23
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A80707 mov eax, dword ptr fs:[00000030h]0_2_02A80707
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A80707 mov eax, dword ptr fs:[00000030h]0_2_02A80707
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A45F16 mov eax, dword ptr fs:[00000030h]0_2_02A45F16
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A45F16 mov eax, dword ptr fs:[00000030h]0_2_02A45F16
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A45F16 mov eax, dword ptr fs:[00000030h]0_2_02A45F16
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A77F14 mov eax, dword ptr fs:[00000030h]0_2_02A77F14
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A77F14 mov eax, dword ptr fs:[00000030h]0_2_02A77F14
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FF1F mov eax, dword ptr fs:[00000030h]0_2_02A4FF1F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FF1F mov ecx, dword ptr fs:[00000030h]0_2_02A4FF1F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FF1F mov eax, dword ptr fs:[00000030h]0_2_02A4FF1F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FF1F mov eax, dword ptr fs:[00000030h]0_2_02A4FF1F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FF1F mov eax, dword ptr fs:[00000030h]0_2_02A4FF1F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4FF1F mov eax, dword ptr fs:[00000030h]0_2_02A4FF1F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5171B mov eax, dword ptr fs:[00000030h]0_2_02A5171B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A47CA4 mov eax, dword ptr fs:[00000030h]0_2_02A47CA4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A47CA4 mov ecx, dword ptr fs:[00000030h]0_2_02A47CA4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A47CA4 mov eax, dword ptr fs:[00000030h]0_2_02A47CA4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A564A4 mov eax, dword ptr fs:[00000030h]0_2_02A564A4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A564A4 mov eax, dword ptr fs:[00000030h]0_2_02A564A4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A77CBC mov eax, dword ptr fs:[00000030h]0_2_02A77CBC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A77CBC mov eax, dword ptr fs:[00000030h]0_2_02A77CBC
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A9A4B6 mov eax, dword ptr fs:[00000030h]0_2_02A9A4B6
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A9A4B6 mov ecx, dword ptr fs:[00000030h]0_2_02A9A4B6
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A9649F mov eax, dword ptr fs:[00000030h]0_2_02A9649F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A9649F mov eax, dword ptr fs:[00000030h]0_2_02A9649F
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7F4CA mov eax, dword ptr fs:[00000030h]0_2_02A7F4CA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A7F4CA mov ecx, dword ptr fs:[00000030h]0_2_02A7F4CA
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55CD0 mov eax, dword ptr fs:[00000030h]0_2_02A55CD0
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A80CD5 mov eax, dword ptr fs:[00000030h]0_2_02A80CD5
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A80CD5 mov eax, dword ptr fs:[00000030h]0_2_02A80CD5
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A80CD5 mov eax, dword ptr fs:[00000030h]0_2_02A80CD5
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A46C24 mov eax, dword ptr fs:[00000030h]0_2_02A46C24
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A46C24 mov ecx, dword ptr fs:[00000030h]0_2_02A46C24
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A45C24 mov eax, dword ptr fs:[00000030h]0_2_02A45C24
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A81440 mov eax, dword ptr fs:[00000030h]0_2_02A81440
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A81440 mov eax, dword ptr fs:[00000030h]0_2_02A81440
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5844E mov eax, dword ptr fs:[00000030h]0_2_02A5844E
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5844E mov eax, dword ptr fs:[00000030h]0_2_02A5844E
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5844E mov eax, dword ptr fs:[00000030h]0_2_02A5844E
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5844E mov eax, dword ptr fs:[00000030h]0_2_02A5844E
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A8BC57 mov eax, dword ptr fs:[00000030h]0_2_02A8BC57
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A81D8A mov eax, dword ptr fs:[00000030h]0_2_02A81D8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A81D8A mov ecx, dword ptr fs:[00000030h]0_2_02A81D8A
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5958C mov ecx, dword ptr fs:[00000030h]0_2_02A5958C
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5958C mov eax, dword ptr fs:[00000030h]0_2_02A5958C
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A87DC4 mov eax, dword ptr fs:[00000030h]0_2_02A87DC4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A87DC4 mov eax, dword ptr fs:[00000030h]0_2_02A87DC4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A87DC4 mov eax, dword ptr fs:[00000030h]0_2_02A87DC4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A87DC4 mov eax, dword ptr fs:[00000030h]0_2_02A87DC4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A87DC4 mov ecx, dword ptr fs:[00000030h]0_2_02A87DC4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A905C6 mov esi, dword ptr fs:[00000030h]0_2_02A905C6
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A46504 mov eax, dword ptr fs:[00000030h]0_2_02A46504
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A46504 mov ecx, dword ptr fs:[00000030h]0_2_02A46504
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A46504 mov eax, dword ptr fs:[00000030h]0_2_02A46504
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A45D11 mov eax, dword ptr fs:[00000030h]0_2_02A45D11
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A45D11 mov eax, dword ptr fs:[00000030h]0_2_02A45D11
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4951B mov eax, dword ptr fs:[00000030h]0_2_02A4951B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4951B mov eax, dword ptr fs:[00000030h]0_2_02A4951B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A4951B mov eax, dword ptr fs:[00000030h]0_2_02A4951B
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55D74 mov eax, dword ptr fs:[00000030h]0_2_02A55D74
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A55D74 mov eax, dword ptr fs:[00000030h]0_2_02A55D74
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58D54 mov eax, dword ptr fs:[00000030h]0_2_02A58D54
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58D54 mov eax, dword ptr fs:[00000030h]0_2_02A58D54
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A58D54 mov ecx, dword ptr fs:[00000030h]0_2_02A58D54
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5CD54 mov eax, dword ptr fs:[00000030h]0_2_02A5CD54
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5CD54 mov eax, dword ptr fs:[00000030h]0_2_02A5CD54
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5CD54 mov eax, dword ptr fs:[00000030h]0_2_02A5CD54
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A59AB4 mov eax, dword ptr fs:[00000030h]0_2_02A59AB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A59AB4 mov eax, dword ptr fs:[00000030h]0_2_02A59AB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A59AB4 mov eax, dword ptr fs:[00000030h]0_2_02A59AB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A59AB4 mov eax, dword ptr fs:[00000030h]0_2_02A59AB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A59AB4 mov eax, dword ptr fs:[00000030h]0_2_02A59AB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A59AB4 mov eax, dword ptr fs:[00000030h]0_2_02A59AB4
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5B399 mov eax, dword ptr fs:[00000030h]0_2_02A5B399
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5B399 mov eax, dword ptr fs:[00000030h]0_2_02A5B399
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5B399 mov eax, dword ptr fs:[00000030h]0_2_02A5B399
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5B399 mov eax, dword ptr fs:[00000030h]0_2_02A5B399
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5B399 mov eax, dword ptr fs:[00000030h]0_2_02A5B399
            Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02A5B399 mov eax, dword ptr fs:[00000030h]0_2_02A5B399
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470465 mov eax, dword ptr fs:[00000030h]3_2_04470465
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470465 mov eax, dword ptr fs:[00000030h]3_2_04470465
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470465 mov eax, dword ptr fs:[00000030h]3_2_04470465
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470465 mov eax, dword ptr fs:[00000030h]3_2_04470465
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445EC7D mov ebx, dword ptr fs:[00000030h]3_2_0445EC7D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445EC7D mov eax, dword ptr fs:[00000030h]3_2_0445EC7D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445EC7D mov ecx, dword ptr fs:[00000030h]3_2_0445EC7D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445EC7D mov eax, dword ptr fs:[00000030h]3_2_0445EC7D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449AC1B mov eax, dword ptr fs:[00000030h]3_2_0449AC1B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449AC1B mov ecx, dword ptr fs:[00000030h]3_2_0449AC1B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04499CD2 mov eax, dword ptr fs:[00000030h]3_2_04499CD2
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04499CD2 mov eax, dword ptr fs:[00000030h]3_2_04499CD2
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449A4FB mov eax, dword ptr fs:[00000030h]3_2_0449A4FB
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044BCCF7 mov eax, dword ptr fs:[00000030h]3_2_044BCCF7
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0448F48D mov eax, dword ptr fs:[00000030h]3_2_0448F48D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0448F48D mov eax, dword ptr fs:[00000030h]3_2_0448F48D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490485 cmp dword ptr fs:[00000030h], ebx3_2_04490485
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490485 mov eax, dword ptr fs:[00000030h]3_2_04490485
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490485 mov eax, dword ptr fs:[00000030h]3_2_04490485
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490485 mov eax, dword ptr fs:[00000030h]3_2_04490485
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A5CA0 mov eax, dword ptr fs:[00000030h]3_2_044A5CA0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A5CA0 mov ecx, dword ptr fs:[00000030h]3_2_044A5CA0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E545 mov eax, dword ptr fs:[00000030h]3_2_0446E545
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E545 mov eax, dword ptr fs:[00000030h]3_2_0446E545
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04460555 mov eax, dword ptr fs:[00000030h]3_2_04460555
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04460555 mov eax, dword ptr fs:[00000030h]3_2_04460555
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04460555 mov eax, dword ptr fs:[00000030h]3_2_04460555
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0448F563 mov eax, dword ptr fs:[00000030h]3_2_0448F563
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0448F563 mov ecx, dword ptr fs:[00000030h]3_2_0448F563
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A5DCC mov eax, dword ptr fs:[00000030h]3_2_044A5DCC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A5DCC mov eax, dword ptr fs:[00000030h]3_2_044A5DCC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A5DCC mov eax, dword ptr fs:[00000030h]3_2_044A5DCC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A5DCC mov eax, dword ptr fs:[00000030h]3_2_044A5DCC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A5DCC mov ecx, dword ptr fs:[00000030h]3_2_044A5DCC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0448EDC1 mov eax, dword ptr fs:[00000030h]3_2_0448EDC1
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A05FF mov eax, dword ptr fs:[00000030h]3_2_044A05FF
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A05FF mov ecx, dword ptr fs:[00000030h]3_2_044A05FF
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A6D9B mov eax, dword ptr fs:[00000030h]3_2_044A6D9B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A6D9B mov ecx, dword ptr fs:[00000030h]3_2_044A6D9B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A6D9B mov eax, dword ptr fs:[00000030h]3_2_044A6D9B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04467595 mov eax, dword ptr fs:[00000030h]3_2_04467595
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AFD9F mov eax, dword ptr fs:[00000030h]3_2_044AFD9F
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AFD9F mov ecx, dword ptr fs:[00000030h]3_2_044AFD9F
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AFD9F mov ecx, dword ptr fs:[00000030h]3_2_044AFD9F
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0447066B mov eax, dword ptr fs:[00000030h]3_2_0447066B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0447066B mov eax, dword ptr fs:[00000030h]3_2_0447066B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04461675 mov eax, dword ptr fs:[00000030h]3_2_04461675
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A6E77 mov eax, dword ptr fs:[00000030h]3_2_044A6E77
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470603 mov eax, dword ptr fs:[00000030h]3_2_04470603
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470603 mov eax, dword ptr fs:[00000030h]3_2_04470603
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470603 mov eax, dword ptr fs:[00000030h]3_2_04470603
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470603 mov eax, dword ptr fs:[00000030h]3_2_04470603
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470E01 mov eax, dword ptr fs:[00000030h]3_2_04470E01
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470E01 mov eax, dword ptr fs:[00000030h]3_2_04470E01
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470E01 mov eax, dword ptr fs:[00000030h]3_2_04470E01
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E6C5 mov eax, dword ptr fs:[00000030h]3_2_0446E6C5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E6C5 mov eax, dword ptr fs:[00000030h]3_2_0446E6C5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AD6FB mov eax, dword ptr fs:[00000030h]3_2_044AD6FB
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AD6FB mov ecx, dword ptr fs:[00000030h]3_2_044AD6FB
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475EF5 mov eax, dword ptr fs:[00000030h]3_2_04475EF5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475EF5 mov eax, dword ptr fs:[00000030h]3_2_04475EF5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475EF5 mov eax, dword ptr fs:[00000030h]3_2_04475EF5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0448EEF3 mov eax, dword ptr fs:[00000030h]3_2_0448EEF3
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04497EF5 mov eax, dword ptr fs:[00000030h]3_2_04497EF5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04497EF5 mov eax, dword ptr fs:[00000030h]3_2_04497EF5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475E9C mov eax, dword ptr fs:[00000030h]3_2_04475E9C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490EA9 mov eax, dword ptr fs:[00000030h]3_2_04490EA9
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490EA9 mov eax, dword ptr fs:[00000030h]3_2_04490EA9
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044BCEA1 mov eax, dword ptr fs:[00000030h]3_2_044BCEA1
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445F745 mov ecx, dword ptr fs:[00000030h]3_2_0445F745
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446FF45 mov eax, dword ptr fs:[00000030h]3_2_0446FF45
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446FF45 mov eax, dword ptr fs:[00000030h]3_2_0446FF45
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446FF45 mov eax, dword ptr fs:[00000030h]3_2_0446FF45
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446FF45 mov eax, dword ptr fs:[00000030h]3_2_0446FF45
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E779 mov eax, dword ptr fs:[00000030h]3_2_0446E779
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E779 mov eax, dword ptr fs:[00000030h]3_2_0446E779
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445F7D5 mov eax, dword ptr fs:[00000030h]3_2_0445F7D5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445F7D5 mov ecx, dword ptr fs:[00000030h]3_2_0445F7D5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445E7D5 mov eax, dword ptr fs:[00000030h]3_2_0445E7D5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04499FF1 mov eax, dword ptr fs:[00000030h]3_2_04499FF1
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04499FF1 mov eax, dword ptr fs:[00000030h]3_2_04499FF1
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470FFF mov eax, dword ptr fs:[00000030h]3_2_04470FFF
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470FFF mov eax, dword ptr fs:[00000030h]3_2_04470FFF
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470FFF mov eax, dword ptr fs:[00000030h]3_2_04470FFF
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04470FFF mov eax, dword ptr fs:[00000030h]3_2_04470FFF
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0447178C mov eax, dword ptr fs:[00000030h]3_2_0447178C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0447178C mov eax, dword ptr fs:[00000030h]3_2_0447178C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471F94 mov ecx, dword ptr fs:[00000030h]3_2_04471F94
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471F94 mov eax, dword ptr fs:[00000030h]3_2_04471F94
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044B0795 mov eax, dword ptr fs:[00000030h]3_2_044B0795
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044B0795 mov ecx, dword ptr fs:[00000030h]3_2_044B0795
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044B0795 mov ecx, dword ptr fs:[00000030h]3_2_044B0795
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04460855 mov eax, dword ptr fs:[00000030h]3_2_04460855
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04460855 mov ecx, dword ptr fs:[00000030h]3_2_04460855
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04460855 mov eax, dword ptr fs:[00000030h]3_2_04460855
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446F055 mov eax, dword ptr fs:[00000030h]3_2_0446F055
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446F055 mov eax, dword ptr fs:[00000030h]3_2_0446F055
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF050 mov eax, dword ptr fs:[00000030h]3_2_044AF050
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF050 mov eax, dword ptr fs:[00000030h]3_2_044AF050
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449086D mov eax, dword ptr fs:[00000030h]3_2_0449086D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449086D mov eax, dword ptr fs:[00000030h]3_2_0449086D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044B3067 mov eax, dword ptr fs:[00000030h]3_2_044B3067
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044B3067 mov ecx, dword ptr fs:[00000030h]3_2_044B3067
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449807B mov eax, dword ptr fs:[00000030h]3_2_0449807B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449807B mov ecx, dword ptr fs:[00000030h]3_2_0449807B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A4808 mov eax, dword ptr fs:[00000030h]3_2_044A4808
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445E8C2 mov eax, dword ptr fs:[00000030h]3_2_0445E8C2
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445E8C2 mov eax, dword ptr fs:[00000030h]3_2_0445E8C2
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044620CC mov eax, dword ptr fs:[00000030h]3_2_044620CC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044620CC mov eax, dword ptr fs:[00000030h]3_2_044620CC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044620CC mov eax, dword ptr fs:[00000030h]3_2_044620CC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E881 mov eax, dword ptr fs:[00000030h]3_2_0446E881
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04499886 mov eax, dword ptr fs:[00000030h]3_2_04499886
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04499886 mov eax, dword ptr fs:[00000030h]3_2_04499886
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04499886 mov eax, dword ptr fs:[00000030h]3_2_04499886
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445F0B5 mov eax, dword ptr fs:[00000030h]3_2_0445F0B5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445F0B5 mov ecx, dword ptr fs:[00000030h]3_2_0445F0B5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445F0B5 mov eax, dword ptr fs:[00000030h]3_2_0445F0B5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A9177 mov esi, dword ptr fs:[00000030h]3_2_044A9177
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A0975 mov eax, dword ptr fs:[00000030h]3_2_044A0975
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A0975 mov eax, dword ptr fs:[00000030h]3_2_044A0975
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A0975 mov eax, dword ptr fs:[00000030h]3_2_044A0975
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A0975 mov eax, dword ptr fs:[00000030h]3_2_044A0975
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044A0975 mov ecx, dword ptr fs:[00000030h]3_2_044A0975
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471905 mov eax, dword ptr fs:[00000030h]3_2_04471905
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471905 mov eax, dword ptr fs:[00000030h]3_2_04471905
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471905 mov ecx, dword ptr fs:[00000030h]3_2_04471905
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475905 mov eax, dword ptr fs:[00000030h]3_2_04475905
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475905 mov eax, dword ptr fs:[00000030h]3_2_04475905
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475905 mov eax, dword ptr fs:[00000030h]3_2_04475905
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E925 mov eax, dword ptr fs:[00000030h]3_2_0446E925
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446E925 mov eax, dword ptr fs:[00000030h]3_2_0446E925
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449A93B mov eax, dword ptr fs:[00000030h]3_2_0449A93B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0449A93B mov ecx, dword ptr fs:[00000030h]3_2_0449A93B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0447213D mov ecx, dword ptr fs:[00000030h]3_2_0447213D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0447213D mov eax, dword ptr fs:[00000030h]3_2_0447213D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF1E8 mov eax, dword ptr fs:[00000030h]3_2_044AF1E8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF1E8 mov eax, dword ptr fs:[00000030h]3_2_044AF1E8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF1E8 mov eax, dword ptr fs:[00000030h]3_2_044AF1E8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF1E8 mov eax, dword ptr fs:[00000030h]3_2_044AF1E8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF1E8 mov eax, dword ptr fs:[00000030h]3_2_044AF1E8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF1E8 mov ecx, dword ptr fs:[00000030h]3_2_044AF1E8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AF9F8 mov eax, dword ptr fs:[00000030h]3_2_044AF9F8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468A09 mov ecx, dword ptr fs:[00000030h]3_2_04468A09
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468A09 mov eax, dword ptr fs:[00000030h]3_2_04468A09
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AEA3B mov eax, dword ptr fs:[00000030h]3_2_044AEA3B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AEA3B mov eax, dword ptr fs:[00000030h]3_2_044AEA3B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AEA3B mov eax, dword ptr fs:[00000030h]3_2_044AEA3B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AEA3B mov ecx, dword ptr fs:[00000030h]3_2_044AEA3B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AEA3B mov eax, dword ptr fs:[00000030h]3_2_044AEA3B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AEA3B mov ecx, dword ptr fs:[00000030h]3_2_044AEA3B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044B0A3D mov ecx, dword ptr fs:[00000030h]3_2_044B0A3D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044B0A3D mov ecx, dword ptr fs:[00000030h]3_2_044B0A3D
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445EAC7 mov eax, dword ptr fs:[00000030h]3_2_0445EAC7
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445EAC7 mov eax, dword ptr fs:[00000030h]3_2_0445EAC7
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0445EAC7 mov eax, dword ptr fs:[00000030h]3_2_0445EAC7
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0446A2CC mov eax, dword ptr fs:[00000030h]3_2_0446A2CC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490AC5 mov eax, dword ptr fs:[00000030h]3_2_04490AC5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04490AC5 mov eax, dword ptr fs:[00000030h]3_2_04490AC5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468AD0 mov eax, dword ptr fs:[00000030h]3_2_04468AD0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468AD0 mov ecx, dword ptr fs:[00000030h]3_2_04468AD0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468AD0 mov eax, dword ptr fs:[00000030h]3_2_04468AD0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468AD0 mov eax, dword ptr fs:[00000030h]3_2_04468AD0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468AD0 mov eax, dword ptr fs:[00000030h]3_2_04468AD0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04468AD0 mov eax, dword ptr fs:[00000030h]3_2_04468AD0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04498AD4 mov eax, dword ptr fs:[00000030h]3_2_04498AD4
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04498AD4 mov eax, dword ptr fs:[00000030h]3_2_04498AD4
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04465A85 mov eax, dword ptr fs:[00000030h]3_2_04465A85
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04465A85 mov ecx, dword ptr fs:[00000030h]3_2_04465A85
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471A94 mov eax, dword ptr fs:[00000030h]3_2_04471A94
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471A94 mov eax, dword ptr fs:[00000030h]3_2_04471A94
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04471A94 mov ecx, dword ptr fs:[00000030h]3_2_04471A94
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044992B8 mov eax, dword ptr fs:[00000030h]3_2_044992B8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044992B8 mov eax, dword ptr fs:[00000030h]3_2_044992B8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AEB6A mov eax, dword ptr fs:[00000030h]3_2_044AEB6A
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04469B6C mov eax, dword ptr fs:[00000030h]3_2_04469B6C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04469B6C mov eax, dword ptr fs:[00000030h]3_2_04469B6C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04469B6C mov eax, dword ptr fs:[00000030h]3_2_04469B6C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04469B6C mov eax, dword ptr fs:[00000030h]3_2_04469B6C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04469B6C mov eax, dword ptr fs:[00000030h]3_2_04469B6C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044BCB65 mov eax, dword ptr fs:[00000030h]3_2_044BCB65
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044BCB65 mov eax, dword ptr fs:[00000030h]3_2_044BCB65
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044BCB65 mov eax, dword ptr fs:[00000030h]3_2_044BCB65
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044BCB65 mov eax, dword ptr fs:[00000030h]3_2_044BCB65
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AFB88 mov eax, dword ptr fs:[00000030h]3_2_044AFB88
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AFB88 mov ecx, dword ptr fs:[00000030h]3_2_044AFB88
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_044AFB88 mov ecx, dword ptr fs:[00000030h]3_2_044AFB88
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04475BA5 mov eax, dword ptr fs:[00000030h]3_2_04475BA5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04472665 mov eax, dword ptr fs:[00000030h]3_2_04472665
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04472665 mov eax, dword ptr fs:[00000030h]3_2_04472665
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04472665 mov eax, dword ptr fs:[00000030h]3_2_04472665
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04472665 mov eax, dword ptr fs:[00000030h]3_2_04472665
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04472665 mov eax, dword ptr fs:[00000030h]3_2_04472665
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04472665 mov eax, dword ptr fs:[00000030h]3_2_04472665
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04473F4A mov eax, dword ptr fs:[00000030h]3_2_04473F4A
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04473F4A mov eax, dword ptr fs:[00000030h]3_2_04473F4A
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04473F4A mov eax, dword ptr fs:[00000030h]3_2_04473F4A
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04473F4A mov eax, dword ptr fs:[00000030h]3_2_04473F4A
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04473F4A mov eax, dword ptr fs:[00000030h]3_2_04473F4A
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04473F4A mov eax, dword ptr fs:[00000030h]3_2_04473F4A
            Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPort
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPort
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPort
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPort
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPort
            Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPort

            HIPS / PFW / Operating System Protection Evasion

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 15.228.77.178 80Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeDomain query: ebaoffice.com.br
            Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 187.45.187.42 443Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1Jump to behavior
            Source: loaddll32.exe, 00000000.00000003.425768048.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.749181880.0000000003173000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764406346.0000000004B7F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: GetProgmanWindow
            Source: loaddll32.exe, 00000000.00000003.425768048.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.749181880.0000000003173000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764406346.0000000004B7F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: SetProgmanWindow
            Source: C:\Windows\SysWOW64\rundll32.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
            Source: rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid Accounts1
            Windows Management Instrumentation            		11
            Registry Run Keys / Startup Folder            		112
            Process Injection            		1
            Masquerading            		21
            Input Capture            		331
            Security Software Discovery            		Remote Services21
            Input Capture            		Exfiltration Over Other Network Medium11
            Encrypted Channel            		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/Job1
            DLL Side-Loading            		11
            Registry Run Keys / Startup Folder            		121
            Virtualization/Sandbox Evasion            		LSASS Memory1
            Process Discovery            		Remote Desktop Protocol1
            Archive Collected Data            		Exfiltration Over Bluetooth1
            Ingress Tool Transfer            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)1
            DLL Side-Loading            		112
            Process Injection            		Security Account Manager121
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
            Non-Application Layer Protocol            		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
            Deobfuscate/Decode Files or Information            		NTDS1
            Remote System Discovery            		Distributed Component Object ModelInput CaptureScheduled Transfer13
            Application Layer Protocol            		SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script3
            Obfuscated Files or Information            		LSA Secrets21
            System Information Discovery            		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.common1
            Rundll32            		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup Items1
            Software Packing            		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
            DLL Side-Loading            		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1280994 Sample: SecuriteInfo.com.Variant.Ba... Startdate: 27/07/2023 Architecture: WINDOWS Score: 88 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Machine Learning detection for sample 2->48 50 PE file has a writeable .text section 2->50 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        13 rundll32.exe 2->13         started        process3 signatures4 52 Tries to evade debugger and weak emulator (self modifying code) 8->52 54 Tries to detect virtualization through RDTSC time measurements 8->54 56 Hides threads from debuggers 8->56 15 rundll32.exe 1 17 8->15         started        19 cmd.exe 1 8->19         started        21 rundll32.exe 14 8->21         started        23 8 other processes 8->23 process5 dnsIp6 30 ebaoffice.com.br 187.45.187.42, 443, 49700 DIMENOCUS Brazil 15->30 32 15.228.77.178, 80 AMAZON-02US United States 15->32 36 System process connects to network (likely due to code injection or exploit) 15->36 38 Creates an autostart registry key pointing to binary in C:\Windows 15->38 40 Tries to detect virtualization through RDTSC time measurements 15->40 25 rundll32.exe 19->25         started        34 192.168.2.1 unknown unknown 21->34 42 Hides threads from debuggers 21->42 signatures7 process8 signatures9 58 Hides threads from debuggers 25->58 28 WerFault.exe 24 9 25->28         started        process10

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll58%ReversingLabsWin32.Trojan.Barys
            SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll63%VirustotalBrowse
            SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            ebaoffice.com.br2%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            https://ebaoffice.com.br/imagens/bo/inspecionando.php7&0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.php20%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phptigs0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.php-0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpp0%Avira URL Cloudsafe
            http://www.indyproject.org/0%URL Reputationsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpx0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpM0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.php)D0o0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phps/bo/inspecionando.phpo.php80%Avira URL Cloudsafe
            https://ebaoffice.com.br/0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phptCookies0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.php...0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phph0%Avira URL Cloudsafe
            https://ebaoffice.com.br/(0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpph0%Avira URL Cloudsafe
            https://ebaoffice.com.br/E0%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpHistory.IE50%Avira URL Cloudsafe
            https://ebaoffice.com.br/imagens/bo/inspecionando.php100%Avira URL Cloudmalware

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            ebaoffice.com.br
            		187.45.187.42
            		truetrueunknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://ebaoffice.com.br/imagens/bo/inspecionando.phptrue
            • Avira URL Cloud: malware
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://ebaoffice.com.br/imagens/bo/inspecionando.php7&rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.php2rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phptigsrundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpprundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.php-rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpMrundll32.exe, 00000005.00000002.496695244.0000000003447000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.php)D0orundll32.exe, 00000003.00000002.761369854.000000000097E000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpxrundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phps/bo/inspecionando.phpo.php8rundll32.exe, 00000003.00000002.761369854.000000000097E000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.php...rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.761369854.000000000098D000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phptCookiesrundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.indyproject.org/loaddll32.exe, 00000000.00000003.742798207.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.764773351.0000000004DA0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.637919111.000000006AAA9000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.637334819.0000000004A80000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phphrundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/(rundll32.exe, 00000003.00000002.766643170.0000000006B30000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpHistory.IE5rundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/Erundll32.exe, 00000003.00000002.761369854.0000000000936000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://ebaoffice.com.br/imagens/bo/inspecionando.phpphrundll32.exe, 00000003.00000002.761369854.00000000009A1000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            15.228.77.178
            		unknownUnited States
            		16509AMAZON-02UStrue
            187.45.187.42
            		ebaoffice.com.brBrazil
            		33182DIMENOCUStrue

            Private

            IP
            192.168.2.1

            General Information

            Joe Sandbox Version:38.0.0 Beryl
            Analysis ID:1280994
            Start date and time:2023-07-27 11:58:46 +02:00
            Joe Sandbox Product:CloudBasic
            Overall analysis duration:0h 14m 16s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
            Run name:Run with higher sleep bypass
            Number of analysed new started processes analysed:22
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • HDC enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample file name:SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll
            Detection:MAL
            Classification:mal88.evad.winDLL@27/7@1/3
            EGA Information:Failed
            HDC Information:Failed
            HCA Information:Failed
            Cookbook Comments:
            • Found application associated with file extension: .dll
            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

            Warnings

            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
            • Excluded IPs from analysis (whitelisted): 20.189.173.21
            • Excluded domains from analysis (whitelisted): login.live.com, ocsp.msocsp.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, watson.telemetry.microsoft.com
            • Execution Graph export aborted for target loaddll32.exe, PID 7248 because it is empty
            • Execution Graph export aborted for target rundll32.exe, PID 7292 because it is empty
            • Not all processes where analyzed, report is missing behavior information
            • Report creation exceeded maximum time and may have missing disassembly code information.
            • Report size exceeded maximum capacity and may have missing behavior information.
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtProtectVirtualMemory calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.

            Simulations

            Behavior and APIs

            TimeTypeDescription
            12:01:43AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run rundll32.exe C:\Windows\SysWOW64\rundll32.exe
            12:01:53AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run rundll32.exe C:\Windows\SysWOW64\rundll32.exe

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            15.228.77.178f_4_T_u_r_4_34536_45645_3345_wo.msiGet hashmaliciousUnknownBrowse
              n_f_3_e_l_3_t_r_0_n_1_k_4_00545.msiGet hashmaliciousUnknownBrowse
                n_f_3_f_1_s_k_4_l.msiGet hashmaliciousUnknownBrowse
                  Mandado-Intima#U00e7#U00e3o_Art516mlhg.msiGet hashmaliciousUnknownBrowse
                    z12A____o-Trabalhista.msiGet hashmaliciousUnknownBrowse
                      z1F_4_T_U_r_4_2024mfdfgryry5.msiGet hashmaliciousUnknownBrowse
                        F_4_T_U_R_4___nf____0992344.4354.msiGet hashmaliciousUnknownBrowse
                          rPEDIDOS-10032023-X491kkum.msiGet hashmaliciousUnknownBrowse
                            z93nf_e_mnhhh345553.msiGet hashmaliciousUnknownBrowse
                              z1n_f_e_Fa_tu_r4_03.msiGet hashmaliciousUnknownBrowse
                                PEDIDOS-08032023-X388omke.msiGet hashmaliciousUnknownBrowse
                                  Nota-LG-emitida-13488mhqt.msiGet hashmaliciousUnknownBrowse
                                    __B0L3T0_06Marc_23_f4tur4__.msiGet hashmaliciousUnknownBrowse
                                      __B0L3T0_06Marc_23_f4tur4__.msiGet hashmaliciousUnknownBrowse
                                        rPedido-Danfe-03-03-202316872pnlc.msiGet hashmaliciousUnknownBrowse
                                          Autos-Processo 27-02-2023 ligh.msiGet hashmaliciousUnknownBrowse
                                            rEmita-Danfe-01-03-20234076czdg.msiGet hashmaliciousUnknownBrowse

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              ebaoffice.com.brf_4_T_u_r_4_34536_45645_3345_wo.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              n_f_3_e_l_3_t_r_0_n_1_k_4_00545.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              n_f_3_f_1_s_k_4_l.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              z1F_4_T_U_r_4_2024mfdfgryry5.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              F_4_T_U_R_4___nf____0992344.4354.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              z93nf_e_mnhhh345553.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              z1n_f_e_Fa_tu_r4_03.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              __B0L3T0_06Marc_23_f4tur4__.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              __B0L3T0_06Marc_23_f4tur4__.msiGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              AMAZON-02USVj9IqABtkW.exeGet hashmaliciousNjratBrowse
                                              • 3.121.139.82
                                              CBaxoveJtw.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • 13.248.169.48
                                              http://gvehealth.com/2681688if6964650sh583289000KO14098WL2LCu185894sAGet hashmaliciousUnknownBrowse
                                              • 54.184.24.62
                                              https://b9halom2.page.link/dmCnGet hashmaliciousUnknownBrowse
                                              • 3.71.149.231
                                              PO_DP-06423.xlam.xlsxGet hashmaliciousUnknownBrowse
                                              • 13.224.103.58
                                              FACTURA_53769.xlam.xlsxGet hashmaliciousUnknownBrowse
                                              • 13.224.103.129
                                              IMG_3846.JPG.........................scr.exeGet hashmaliciousAveMariaBrowse
                                              • 3.135.209.48
                                              doc_pago_de_la_factura_11-369013.xlam.xlsxGet hashmaliciousUnknownBrowse
                                              • 13.224.103.129
                                              cenov#U00e1_nab#U00eddka_a_specifikace.xla.xlsxGet hashmaliciousUnknownBrowse
                                              • 13.224.103.129
                                              http://staging.talentegg.ca/redirect/company/1838/54828?destination=https://SWISSLIFE.fklavye.org.tr/dmF0LnNlcnZpY2VzQHN3aXNzbGlmZS5jb20=Get hashmaliciousHTMLPhisherBrowse
                                              • 18.190.15.219
                                              https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=twinmotionGet hashmaliciousUnknownBrowse
                                              • 13.225.78.57
                                              New_Order_Inquiry.xla.xlsxGet hashmaliciousUnknownBrowse
                                              • 13.224.103.87
                                              http://t.1800petmeds.com/track?t=c&mid=26061&eid=LORI@NEXTSTEPMINISTRIES.NET&extra=2&&&http://w1ph62.aynacigold.com/RHVsbGFoLk1hemxhbkBkZW1lLm9ubWljcm9zb2Z0LmNvbQ==Get hashmaliciousUnknownBrowse
                                              • 3.127.67.224
                                              http://t.1800petmeds.com/track?t=c&mid=26061&eid=LORI@NEXTSTEPMINISTRIES.NET&extra=2&&&http://w1ph62.aynacigold.com/RHVsbGFoLk1hemxhbkBkZW1lLm9ubWljcm9zb2Z0LmNvbQ==Get hashmaliciousUnknownBrowse
                                              • 3.127.67.224
                                              Endpoint Agent for Architects , Inc-x64-1.166.1.msiGet hashmaliciousUnknownBrowse
                                              • 99.83.250.143
                                              system32.vbsGet hashmaliciousAgentTeslaBrowse
                                              • 108.138.36.12
                                              https://mg3260068.cc/index.html?shareName=mg3260068.ccGet hashmaliciousUnknownBrowse
                                              • 108.138.7.4
                                              message_zdm.htmlGet hashmaliciousUnknownBrowse
                                              • 65.9.66.24
                                              u1LwUkKDIF.exeGet hashmaliciousNjratBrowse
                                              • 18.157.68.73

                                              JA3 Fingerprints

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              37f463bf4616ecd445d4a1937da06e19Remittance_copy.exeGet hashmaliciousGuLoader, LokibotBrowse
                                              • 187.45.187.42
                                              Invoices.lnkGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              Payment_Document.lnkGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              pikabot_core.dllGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              pikabot_core.dllGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              SecuriteInfo.com.Trojan.Heur2.sNW@If4VDppi.27877.25664.exeGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              SecuriteInfo.com.Adware.Zaxar.111.16621.29357.dllGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              1.exeGet hashmaliciousTargeted Ransomware, TrojanRansomBrowse
                                              • 187.45.187.42
                                              kMyL3tnxhT.exeGet hashmaliciousSmokeLoader, VidarBrowse
                                              • 187.45.187.42
                                              0acR8HLrwO.exeGet hashmaliciousVidarBrowse
                                              • 187.45.187.42
                                              New_Inquiry_List.exeGet hashmaliciousGuLoaderBrowse
                                              • 187.45.187.42
                                              lllll.bin.exeGet hashmaliciousAresLoaderBrowse
                                              • 187.45.187.42
                                              NOUVELLE_COMMANDE_-pdf.exeGet hashmaliciousGuLoaderBrowse
                                              • 187.45.187.42
                                              Yfq7dvvNOA.exeGet hashmaliciousBabuk, DjvuBrowse
                                              • 187.45.187.42
                                              NOUVELLE_COMMANDE_-pdf.exeGet hashmaliciousGuLoaderBrowse
                                              • 187.45.187.42
                                              Csz05luwlg.exeGet hashmaliciousUnknownBrowse
                                              • 187.45.187.42
                                              copia_de_la_transferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • 187.45.187.42
                                              IAENMAIL.-A4-230726-0830-0002632.pdf.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                              • 187.45.187.42
                                              Sis.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • 187.45.187.42

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d862df93e87cd362728fa3756347b64a4da65e6_82810a17_1e5da083\Report.wer

                                              Download File
                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):65536
                                              Entropy (8bit):1.0276684606309918
                                              Encrypted:false
                                              SSDEEP:192:Kpid0oXnHBUZMX4jed++sKCT/u7srS274ItWc:gizXHBUZMX4jee/u7srX4ItWc
                                              MD5:97637DE5A934463C310EA92719550459
                                              SHA1:4B64038D1B32D89DCF706735A8F30A7DEA28E819
                                              SHA-256:E3C385EDC0EB64D0350A37814A33AD352055F40ACB3672437D87ECF6B5C486CA
                                              SHA-512:7189A08488098F360FC98CF78F897E99AADD5F4AF1F3A83CE877108C31BFDC81AA9EFCECD285E040DBD6B68E8E8DB5CDD0D52EFEC8AE5B284BA3C25F1528FFE4
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.4.9.5.8.0.2.6.3.3.6.1.3.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.4.9.5.8.0.3.6.8.8.2.9.7.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.4.a.d.7.5.3.-.d.3.3.7.-.4.b.8.b.-.9.c.4.8.-.e.5.1.5.5.9.1.6.e.1.9.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.9.5.1.7.2.1.-.8.f.3.3.-.4.4.2.1.-.a.5.a.3.-.b.6.9.1.b.6.3.5.3.9.6.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.8.8.-.0.0.0.1.-.0.0.1.f.-.4.7.9.f.-.d.1.8.1.b.c.c.0.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER2827.tmp.dmp

                                              Download File
                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                              File Type:Mini DuMP crash report, 14 streams, Thu Jul 27 19:00:27 2023, 0x1205a4 type
                                              Category:dropped
                                              Size (bytes):47524
                                              Entropy (8bit):2.1516333425751677
                                              Encrypted:false
                                              SSDEEP:192:2TCetU1oIPsm0O5SkbB34Jctw2VSSAH4I9GzkzNwP4tHltFnQU:xoI0m75LbBIJctwfnDGowP4tHd
                                              MD5:E2DE15771C8C3C2D9A5E4E0B26FCEDAB
                                              SHA1:834CF1176749FA8E075204852F8670796654B48F
                                              SHA-256:6B0B10FD278A7C67864554D4C98938B16ABD6BD849E1334E67FD4992AED10A68
                                              SHA-512:FA7A6AC5FEC8C81802D58D52638824DA7F902E521A48924037A0E32EBB8F17B0AC4AD710AF7167C44AB1CD9F3CFA8F35A0C16D77875B4B531A28391DF15753DB
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:MDMP....... .........d........................................"4..........T.......8...........T...........p...4........................!...................................................................U...........B......0"......GenuineIntelW...........T..............d.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EFE.tmp.WERInternalMetadata.xml

                                              Download File
                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                              File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):8368
                                              Entropy (8bit):3.6987899002628137
                                              Encrypted:false
                                              SSDEEP:192:Rrl7r3GLNi2Mh6M6Y626fVgmfThSgCprd89bRwsf07m:RrlsNiD6M6Yj6fVgmfThSSRDfV
                                              MD5:44787FA516CF2624BF4121CADDCB7855
                                              SHA1:BDA7CE82C2C34AE5E050BDDAA2CD057F9FF58EBE
                                              SHA-256:5051466D3E406B475E147ED0A32182F1769AEA79FB390A65B0E92C2A98E7A644
                                              SHA-512:E5D984DBE51113874FC27B4A742E87CDB9EC8722ACEF9727C60481CC74D43DB3073AD8E948253281A88716EB1B27B3650B94A87F103359D7D093F8A7A097DE4F
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.0.4.<./.P.i.d.>.......

                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FF9.tmp.xml

                                              Download File
                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):4722
                                              Entropy (8bit):4.499120811929132
                                              Encrypted:false
                                              SSDEEP:48:cvIwSD8zsSJgtWI9brWgc8sqYjM8fm8M4JCdsr8kFJ+q8/Were54SrSxd:uITfg8agrsqY1Jx8YBeGDWxd
                                              MD5:95181CB0205092BBD623391E849B2724
                                              SHA1:FFF0DF97115F042721DCBF1EA7245AACEDDDCB1D
                                              SHA-256:6AAEF019240B4A3B3D036B182ED0EB4DFC64A63CB70A54DCD46E1BF55F8F230B
                                              SHA-512:61D155C1DB5F545E36782B7EB121C5FF9BCCE838203D0935E51E8DEF9F803943E5BD884DEF2807067CF5B3DA778908E4C72AC341BA1A49C623AA243F0E783B60
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2147291" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                              C:\Users\user\AppData\Local\019635

                                              Download File
                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):32
                                              Entropy (8bit):4.515319531114783
                                              Encrypted:false
                                              SSDEEP:3:1EypyAWzg9y:1XpyA0g9y
                                              MD5:49FECAEF102659E6ABF7CBB6971A37F1
                                              SHA1:4AFC55B9511689E8B18061DE83050FA0CAEADEF9
                                              SHA-256:7FAEB07B72FC30A8F15CEE592A25A853D380820C0089506340E55B4B0793888E
                                              SHA-512:FC41C892E9EF1AE2574E49145AD7866DE7C8DD436BC2CEE4EFAFA575B023BCD999064B921EB9974A677922CB8BC8C5559FC04A00B76310473D5902BBCD81F0D1
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:[Generate Pasta]..SBObpJdVENiu..

                                              C:\Windows\appcompat\Programs\Amcache.hve

                                              Download File
                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                              File Type:MS Windows registry file, NT/2000 or above
                                              Category:dropped
                                              Size (bytes):1572864
                                              Entropy (8bit):4.292749255864657
                                              Encrypted:false
                                              SSDEEP:12288:S63y87VjSuyeG/9mrBsfmdCwa5WVMd26kPF7nyvJdbzUuyTbn3F+K8H:Zy87VjSuyeG/9mYtp
                                              MD5:CECE15C079011887EFD280E9FEB7128D
                                              SHA1:B5F2E9CFE61E8AC68C521EEA9B2CAAD5247508C3
                                              SHA-256:8E01E6618F23CE85248F36A5573F17BE89B819ED0683B224E0E9DFDBE3708957
                                              SHA-512:7ADC529ACA1F1038E63C92C85B8115664C57725A4E1C8364DF988FD52AA232B379D9BCCCD311289B79ACFDFC07A1CD1F10808AF3EE62103AA6E66CD90201F9F6
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:regfj...j...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.-..................................................................................................................................................................................................................................................................................................................................................9$.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Windows\appcompat\Programs\Amcache.hve.LOG1

                                              Download File
                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                              File Type:MS Windows registry file, NT/2000 or above
                                              Category:dropped
                                              Size (bytes):28672
                                              Entropy (8bit):3.821509804260257
                                              Encrypted:false
                                              SSDEEP:768:6AeRftx1XJ4JMHQAJfOqicJ6kqQNSC9O4MYOqE:IXx1g
                                              MD5:973BD69584A67F3B40C754E01435EC34
                                              SHA1:C3C85044D8C37EC47234B281C1B27EB684D3DAC7
                                              SHA-256:5869BF599538EC92626FBCCE919EF321B89A28DB6663CC5846D34AE11ECEC740
                                              SHA-512:2AD81CC6DBEC243B512533F1A2C34F2E034E153F7597AA5E1F0A955379EB55B041873D32D049B907B12223A7DCBBFAE2C2C3291F880602C301305AE80C9EFF49
                                              Malicious:false
                                              Reputation:unknown
                                              Preview:regfi...i...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.-..................................................................................................................................................................................................................................................................................................................................................9$.HvLE.n......i...........9.^..{B+..q.z.)..........0...................0..hbin................p.\..,..........nk,.@./.........h........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .@./......... ........................... .......Z.......................Root........lf......Root....nk .@./......................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

                                              Static File Info

                                              General

                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                              Entropy (8bit):7.865740040086561
                                              TrID:
                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.40%
                                              • Win16/32 Executable Delphi generic (2074/23) 0.21%
                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                              • DOS Executable Generic (2002/1) 0.20%
                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                              File name:SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll
                                              File size:7'131'136 bytes
                                              MD5:d4257a85611eb9b8fc7da98ad7cd3b4c
                                              SHA1:10a8821bd70d4afa52388ca04480085b98ac9227
                                              SHA256:a7d13b0ae56c9d7759c0c20a5ea515760dffa8ea4fa366f9092e901b4579499b
                                              SHA512:396355dcb832bbd42bc6cf59e674cd984d1f025b857b35cd707f46657171b6163bc92a2eb55f652d250c13429960369a5f080d44b854148c98018e0dbd561a15
                                              SSDEEP:98304:waK8LG5Sz5CeP4BgLvNb5++Y+wUJ/0Z7mB2tNlXC6vbrFsVBnQgtCnoy:Jtw+6AdjZR4tTXCGNsVB3Coy
                                              TLSH:3576120FE85F8E7BF95B35BBD8A6907BC1620841A6A19DD0A75586C133E737206CF381
                                              File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                              File Icon

                                              Icon Hash:7ae282899bbab082

                                              Static PE Info

                                              General

                                              Entrypoint:0x269e13c
                                              Entrypoint Section:.sedata
                                              Digitally signed:false
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                              Time Stamp:0x640A145F [Thu Mar 9 17:16:15 2023 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:6
                                              OS Version Minor:0
                                              File Version Major:6
                                              File Version Minor:0
                                              Subsystem Version Major:6
                                              Subsystem Version Minor:0
                                              Import Hash:09c711a9d8dffafaecc3bc1dbbc1f663

                                              Entrypoint Preview

                                              Instruction
                                              call 00007FD448672BD1h
                                              push ebx
                                              popad
                                              outsb
                                              imul ebp, dword ptr [bp+65h], 69685320h
                                              insb
                                              outsb
                                              and byte ptr [esi+32h], dh
                                              xor al, 2Eh
                                              xor byte ptr [esi], ch
                                              xor byte ptr [eax], al
                                              pushfd
                                              stc
                                              jmp 00007FD448672B1Ch
                                              adc dh, FFFFFF93h
                                              mov dl, byte ptr [esp+04h]
                                              bsf dx, si
                                              mov ch, 03h
                                              jmp 00007FD448672C1Ah
                                              cmc
                                              bound esi, dword ptr [eax]
                                              xchg eax, edi
                                              bound ecx, dword ptr [ebx]
                                              xor eax, A15237A7h
                                              sbb al, 5Ah
                                              mov dword ptr [ebx], eax
                                              popad
                                              jmp 00007FD44866593Bh
                                              xchg cl, dl
                                              bsr ecx, esi
                                              sub esp, 14h
                                              push word ptr [esp+22h]
                                              mov ch, 68h
                                              lea edx, dword ptr [00000000h+eax*4]
                                              jmp 00007FD448672BD4h
                                              mov byte ptr [3FCCA535h], al
                                              xchg eax, esp
                                              mov esp, 2ED3B426h
                                              cdq
                                              xlatb
                                              mov dword ptr [esp+02h], ebp
                                              push dword ptr [esp+0Ch]
                                              pop dx
                                              pop word ptr [esp+04h]
                                              bswap ecx
                                              mov cl, dl
                                              jmp 00007FD448672B78h
                                              mov ch, 3Fh
                                              mov edx, ebx
                                              or ecx, edx
                                              mov edx, esp
                                              xor ecx, ebp
                                              xchg word ptr [esp+04h], cx
                                              jmp 00007FD448672BE3h
                                              daa
                                              mov esp, 6DC43552h
                                              or dword ptr [eax-08992C75h], ebp
                                              ror dword ptr [edi], 1
                                              mov bl, E9h
                                              mov dh, byte ptr [esp+0Ah]
                                              mov ecx, dword ptr [esp+01h]
                                              cld
                                              jmp 00007FD448672B71h
                                              bswap edx
                                              push dword ptr [esp+06h]
                                              not dh
                                              lea esp, dword ptr [esp+09h]
                                              stc
                                              std
                                              jmp 00007FD448672BCEh
                                              retf
                                              bound ebx, dword ptr [ebp+00C6FFECh]

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x22930260x5e99.sedata
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x234b0c40x154.idata
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x234c0000x600.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x234d0000x394.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x10000x21820000x502e00unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .sedata0x21830000x1c80000x1c7e00False0.6162363757883191data7.114902610616691IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .idata0x234b0000x10000x600False0.3346354166666667data3.575155469094621IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .rsrc0x234c0000x10000x600False0.3463541666666667data2.8971265676761537IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .reloc0x234d0000x10000x400False0.7158203125data5.315543381569861IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                              .sedata0x234e0000x10000x1000False0.78173828125data7.9836033077698IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                              RT_VERSION0x234c0580x458dataEnglishUnited States0.43884892086330934

                                              Imports

                                              DLLImport
                                              shlwapi.dllSHCreateStreamOnFileW
                                              winspool.drvDocumentPropertiesW
                                              comctl32.dllImageList_GetImageInfo
                                              shell32.dllSHGetFolderPathW
                                              user32.dllMoveWindow
                                              version.dllGetFileVersionInfoSizeW
                                              oleaut32.dllSafeArrayPutElement
                                              advapi32.dllRegSetValueExW
                                              msvcrt.dllmemcpy
                                              kernel32.dllSetFileAttributesW
                                              wsock32.dllgethostbyaddr
                                              ole32.dllOleRegEnumVerbs
                                              gdi32.dllPie
                                              Magnification.dllMagSetWindowSource
                                              IPHLPAPI.DLLGetInterfaceInfo
                                              PSAPI.DLLGetMappedFileNameW

                                              Exports

                                              NameOrdinalAddress
                                              PyArg_Parse6690x7ff0f8
                                              PyArg_ParseTuple6680x7ff0f8

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishUnited States

                                              Network Behavior

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Jul 27, 2023 12:00:29.823950052 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:29.824044943 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:29.824166059 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:29.850655079 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:29.850778103 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:30.551341057 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:30.551520109 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:31.602597952 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:31.602662086 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:31.603183985 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:31.603496075 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:31.607611895 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:31.648287058 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:32.297136068 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:32.297310114 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:32.297308922 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:32.297390938 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:32.348005056 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:32.348082066 CEST44349700187.45.187.42192.168.2.3
                                              Jul 27, 2023 12:00:32.348113060 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:00:32.348160982 CEST49700443192.168.2.3187.45.187.42
                                              Jul 27, 2023 12:01:20.242300034 CEST4971080192.168.2.315.228.77.178
                                              Jul 27, 2023 12:01:23.250040054 CEST4971080192.168.2.315.228.77.178
                                              Jul 27, 2023 12:01:29.250493050 CEST4971080192.168.2.315.228.77.178

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Jul 27, 2023 12:00:29.283916950 CEST5238753192.168.2.38.8.8.8
                                              Jul 27, 2023 12:00:29.757869959 CEST53523878.8.8.8192.168.2.3

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Jul 27, 2023 12:00:29.283916950 CEST192.168.2.38.8.8.80x5676Standard query (0)ebaoffice.com.brA (IP address)IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Jul 27, 2023 12:00:29.757869959 CEST8.8.8.8192.168.2.30x5676No error (0)ebaoffice.com.br187.45.187.42A (IP address)IN (0x0001)false

                                              HTTP Request Dependency Graph

                                              • ebaoffice.com.br

                                              HTTPS Proxied Packets

                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                              0192.168.2.349700187.45.187.42443C:\Windows\SysWOW64\rundll32.exe
                                              TimestampkBytes transferredDirectionData
                                              2023-07-27 10:00:31 UTC0OUTGET /imagens/bo/inspecionando.php HTTP/1.1
                                              Accept: */*
                                              Accept-Language: en-US
                                              Accept-Encoding: gzip, deflate
                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                              Host: ebaoffice.com.br
                                              Connection: Keep-Alive
                                              2023-07-27 10:00:32 UTC0INHTTP/1.1 200 OK
                                              Connection: close
                                              x-powered-by: PHP/5.6.40
                                              content-type: text/html; charset=UTF-8
                                              cache-control: public, max-age=0
                                              expires: Thu, 27 Jul 2023 10:00:32 GMT
                                              content-length: 0
                                              date: Thu, 27 Jul 2023 10:00:32 GMT
                                              server: LiteSpeed
                                              x-ua-compatible: IE=Edge,chrome=1
                                              alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"


                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:11:59:44
                                              Start date:27/07/2023
                                              Path:C:\Windows\System32\loaddll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll"
                                              Imagebase:0x8b0000
                                              File size:126'464 bytes
                                              MD5 hash:3B4636AE519868037940CA5C4272091B
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.748770235.0000000002DEB000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              Reputation:high

                                              General

                                              Target ID:1
                                              Start time:11:59:44
                                              Start date:27/07/2023
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff745070000
                                              File size:625'664 bytes
                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high

                                              General

                                              Target ID:2
                                              Start time:11:59:44
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\cmd.exe
                                              Wow64 process (32bit):true
                                              Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1
                                              Imagebase:0xb0000
                                              File size:232'960 bytes
                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high

                                              General

                                              Target ID:3
                                              Start time:11:59:44
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_Parse
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.763552104.0000000004983000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              Reputation:high

                                              General

                                              Target ID:4
                                              Start time:11:59:44
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",#1
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.636014795.0000000004808000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              Reputation:high

                                              General

                                              Target ID:5
                                              Start time:11:59:48
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTuple
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.497484084.0000000005440000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              Reputation:high

                                              General

                                              Target ID:6
                                              Start time:11:59:52
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll,PyArg_ParseTupleAndKeywords
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000002.631051059.0000000004C02000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security

                                              General

                                              Target ID:11
                                              Start time:12:00:23
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                              Wow64 process (32bit):true
                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 740
                                              Imagebase:0xb00000
                                              File size:434'592 bytes
                                              MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language

                                              General

                                              Target ID:12
                                              Start time:12:00:39
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_Parse
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000002.640120125.0000000004EC6000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security

                                              General

                                              Target ID:13
                                              Start time:12:00:39
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTuple
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000003.524835873.0000000004C18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.642962104.0000000004E03000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security

                                              General

                                              Target ID:14
                                              Start time:12:00:39
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",PyArg_ParseTupleAndKeywords
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000003.525120139.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.643065944.0000000004BE0000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security

                                              General

                                              Target ID:15
                                              Start time:12:00:39
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.524953434.0000000004B75000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.632355714.0000000004D6A000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security

                                              General

                                              Target ID:16
                                              Start time:12:00:39
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000003.525296608.0000000004769000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.644122819.000000000495B000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security

                                              General

                                              Target ID:17
                                              Start time:12:00:39
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Barys.394881.27394.14169.dll",dbkFCallWrapperAddr
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Yara matches:
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000011.00000002.639239677.000000000512E000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000011.00000003.525729460.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

                                              General

                                              Target ID:20
                                              Start time:12:01:53
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Windows\SysWOW64\rundll32.exe"
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language

                                              General

                                              Target ID:21
                                              Start time:12:02:02
                                              Start date:27/07/2023
                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Windows\SysWOW64\rundll32.exe"
                                              Imagebase:0xd60000
                                              File size:61'952 bytes
                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language

                                              Disassembly

                                              Reset < >

                                                Executed Functions

                                                Function 02A49DE4 Relevance: .0, Instructions: 16COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a0f92504597c5fd3659a15538e98a4f4747d652451de23a955b19c726c6a3bf7
                                                • Instruction ID: c5ee853a7d2dd2fdb09030694d333f654cf3f5f02362da729864fd5f821a4da6
                                                • Opcode Fuzzy Hash: a0f92504597c5fd3659a15538e98a4f4747d652451de23a955b19c726c6a3bf7
                                                • Instruction Fuzzy Hash: 23D01C7700010DBBCF028E80DC01EEA3F2AEB48770F048200BE34410A2CA72C8B1EBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A4A8E4 Relevance: .0, Instructions: 9COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b200da480727bac1d901e92a6fbd9acb7fc23ab9598d7933830564d886f5fec3
                                                • Instruction ID: cce4adcb76ca4f0ea415b6a77eed14d6e62662a5b7ce397328b4af7475ec81a5
                                                • Opcode Fuzzy Hash: b200da480727bac1d901e92a6fbd9acb7fc23ab9598d7933830564d886f5fec3
                                                • Instruction Fuzzy Hash: 60C04C3704010CFB8F025F91D904C897F2AEB94760B008011F918050218B32D931FB55
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Non-executed Functions

                                                Function 02A4FF1F Relevance: 4.9, Strings: 3, Instructions: 1157COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: $9$B
                                                • API String ID: 0-1781792629
                                                • Opcode ID: 3b135d63fd314de2f05a1d862d6b2993a5ebd35b4cc34b01c8c2655873818d34
                                                • Instruction ID: d96753d693e318bc26a6ba0170c25542fc4a0bedb9d4e55754b82a18d9b8d33f
                                                • Opcode Fuzzy Hash: 3b135d63fd314de2f05a1d862d6b2993a5ebd35b4cc34b01c8c2655873818d34
                                                • Instruction Fuzzy Hash: 53B25975D012258FDB259F28CC88BAABBB4FF48704F1441EAED49E7251DB709A85CF50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A81440 Relevance: 4.2, Strings: 3, Instructions: 423COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: $ $@
                                                • API String ID: 0-2546599590
                                                • Opcode ID: 9cf6932616d44708e7b255c4f90d851324df64e2282a0c739d5ff7aefb15db7e
                                                • Instruction ID: a4dc4a95015fe7b92dfb09d777b092d2661b39bb7dd5be5178b094ee0e89b9b6
                                                • Opcode Fuzzy Hash: 9cf6932616d44708e7b255c4f90d851324df64e2282a0c739d5ff7aefb15db7e
                                                • Instruction Fuzzy Hash: 87F1CE72604740AFD726DF24C889A6BBBF9FF84714F140A1DF49A872A0EB70E546CB51
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A55D74 Relevance: 1.7, Strings: 1, Instructions: 495COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: acdb612217b59a7e8ff30b0c2e46318959bf4473fad4fee30c4491d49d703515
                                                • Instruction ID: accec17de7d2a47555019ba63dbecded88f9460774611054b5809c96a64fb165
                                                • Opcode Fuzzy Hash: acdb612217b59a7e8ff30b0c2e46318959bf4473fad4fee30c4491d49d703515
                                                • Instruction Fuzzy Hash: 1C32EFB55083819FD761CF29C480B9BBBF9BF88704F50892EE999C7250EB71E945CB42
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A80CD5 Relevance: 1.6, Strings: 1, Instructions: 361COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID: 0-3916222277
                                                • Opcode ID: c9dc39e347207dcd1529615108335aa134f8fb4b588349ee2f4f396f80cb3ee7
                                                • Instruction ID: 65cb3d563561c53b8320151e0e9d4bed29562193937f56409ebf5b3784d409d2
                                                • Opcode Fuzzy Hash: c9dc39e347207dcd1529615108335aa134f8fb4b588349ee2f4f396f80cb3ee7
                                                • Instruction Fuzzy Hash: 94E169B1D01654CFCB28DF98D9806ADFBF2FF88704F15815AE809AB315EB719845CB94
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A7FF23 Relevance: 1.5, Strings: 1, Instructions: 295COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: e1e6bff360ca4c1ac902c2c1ba22db73dcd88533e78ffe1d5c6e1997082878c7
                                                • Instruction ID: 89bf2a8d537aa4c5428443c4635d3b74502690e7afb4f807f011579f06eb8bd7
                                                • Opcode Fuzzy Hash: e1e6bff360ca4c1ac902c2c1ba22db73dcd88533e78ffe1d5c6e1997082878c7
                                                • Instruction Fuzzy Hash: 4AB13BB2D002199FDB11DFA4DC84BEEBBB8FF48310F05452AE915E7251EB749949CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5E082 Relevance: 1.5, Strings: 1, Instructions: 216COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: qrks
                                                • API String ID: 0-3937875505
                                                • Opcode ID: c2090116d312ba7575f9929cbb12c9400cf9cd2b051a7a0ac8080f97b42739d5
                                                • Instruction ID: bb6b09f2512d0f9c34fa5adce6daf5518cf20f322539b7de9b618ed632ad3b22
                                                • Opcode Fuzzy Hash: c2090116d312ba7575f9929cbb12c9400cf9cd2b051a7a0ac8080f97b42739d5
                                                • Instruction Fuzzy Hash: 03818271A41229ABDB208F11DDC8BEBB7B9EB54724F1441EAE909E3254DF309F85CE50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A45D11 Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: 8
                                                • API String ID: 0-4194326291
                                                • Opcode ID: 65494e8a837af176848758caafb48e9bb14954bd687cf70c861311373fdcb2fe
                                                • Instruction ID: f15178c53526f2580f45b046047c8575c276b1245e00a3b52abefc66af990ad8
                                                • Opcode Fuzzy Hash: 65494e8a837af176848758caafb48e9bb14954bd687cf70c861311373fdcb2fe
                                                • Instruction Fuzzy Hash: 28512672D40628EBDB229FE5CC88E9EFBB9FF84705F004419E515AA161DFB18915CF50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A8D21B Relevance: 1.4, Strings: 1, Instructions: 160COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: e34c0cf68bb2309acc4c903c4f133c82283b14d81aec725873e4ca1d98694f87
                                                • Instruction ID: f2634d4b3740c0470c01bdedf19f09e8d90e90af34f0ee6b619a2910bf9a984f
                                                • Opcode Fuzzy Hash: e34c0cf68bb2309acc4c903c4f133c82283b14d81aec725873e4ca1d98694f87
                                                • Instruction Fuzzy Hash: 98518172981618AFDB21EF64DC88F9AB7B8FB48704F000599E509E7291DB70DA51CF50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A96FD7 Relevance: 1.4, Strings: 1, Instructions: 145COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: a535b65ed515169b05ac8ae93d21e082158108cbd7205a178d82734450c2e311
                                                • Instruction ID: 4bfcc056109af29da0f837b864d0739b902c74705d3e1214c796bb61e08691ec
                                                • Opcode Fuzzy Hash: a535b65ed515169b05ac8ae93d21e082158108cbd7205a178d82734450c2e311
                                                • Instruction Fuzzy Hash: 9741B4B1E80218ABDB118B95CC84FAEFBB9EB44715F000165F944B7391DB719E05CBA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A95FB9 Relevance: 1.4, Strings: 1, Instructions: 141COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: 95ee9b392dddb965f90b07225394d8e0dbe60f81177d0256fceb154786876e9c
                                                • Instruction ID: a087a9ab633a5f042b319703794e61d7ae332536797acbb48b354122ae211023
                                                • Opcode Fuzzy Hash: 95ee9b392dddb965f90b07225394d8e0dbe60f81177d0256fceb154786876e9c
                                                • Instruction Fuzzy Hash: 1851F572E402199BDF15DFA5C991AEEFBF9BF08714F11402AEA04F7241EB74A9058F90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A55994 Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID: 0-3916222277
                                                • Opcode ID: 27be5f68c42baa6bf423bf6abf57f5d3f9167f0c0193b614e8d83d568f55f51a
                                                • Instruction ID: 89f6e6667c777f509c3c36875512e3d3fc3128c57217f76ad0aba30680fbb860
                                                • Opcode Fuzzy Hash: 27be5f68c42baa6bf423bf6abf57f5d3f9167f0c0193b614e8d83d568f55f51a
                                                • Instruction Fuzzy Hash: 3E418E72D40619EFDB118BA4C888FAFB7B8FB48764F414159FE11E7290EB709904CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5171B Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID: 0-3916222277
                                                • Opcode ID: 397f0444ded5df0338fa537da592bc9e52153943d801ede4b6ad89d0ca09367e
                                                • Instruction ID: e1f47f5a6f502ec02e655e38897b3033bf96fa59f30369e0e194e386ed32d4b8
                                                • Opcode Fuzzy Hash: 397f0444ded5df0338fa537da592bc9e52153943d801ede4b6ad89d0ca09367e
                                                • Instruction Fuzzy Hash: 9C412575A00218AFDF119F99C984AEEBBB6EB88314F104165FD19A3250DA32D951DF50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A8D0EF Relevance: 1.4, Strings: 1, Instructions: 102COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: 4b680da086af4aac7b510936483f2e305b3df1dd97b6a01af247d98145e0e436
                                                • Instruction ID: e58188bedffa22c006de1014b258c080084ea0ca938370a7b8d748079ef3752a
                                                • Opcode Fuzzy Hash: 4b680da086af4aac7b510936483f2e305b3df1dd97b6a01af247d98145e0e436
                                                • Instruction Fuzzy Hash: 16319271A41618AFDB21EFA1CC49FBEBBBCEF48705F004469E505A6181DB70DA05CF61
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A76210 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: (
                                                • API String ID: 0-3887548279
                                                • Opcode ID: 30dbf750d1cfebb9c2d300dc2c1353b55f4dc582cb89c34cb9a7936dfaa4ee38
                                                • Instruction ID: 7337a9659083c6f04d1e8389c2ddab044d770510e2a6dd8fda4a0be45196e8cc
                                                • Opcode Fuzzy Hash: 30dbf750d1cfebb9c2d300dc2c1353b55f4dc582cb89c34cb9a7936dfaa4ee38
                                                • Instruction Fuzzy Hash: 5C41EDB1D00608DFDB21CFAAC884B9DFBB9BF08714F54842AE459BB250CB749945CF94
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A55B14 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID: 0-3916222277
                                                • Opcode ID: 73f35b253faaf5151ef83cbb11074cb0c3df71365bcf4b2257cb5693425d6a45
                                                • Instruction ID: e1d0199820f2ef09b77c8f3bf173d7463379d2cf2999328df95252b71ca6e394
                                                • Opcode Fuzzy Hash: 73f35b253faaf5151ef83cbb11074cb0c3df71365bcf4b2257cb5693425d6a45
                                                • Instruction Fuzzy Hash: 4021D8B1A00658DFD710CF54C988BABB7F9EB44718F4140A9EE41AB241DBB49D05CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A46B94 Relevance: 1.3, Strings: 1, Instructions: 41COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID: 0-3916222277
                                                • Opcode ID: 0b31c1cb01b0ea8030915de7962c80d906b64f010f1f32d504b4d9f5450a8081
                                                • Instruction ID: b34e49815d0c6bf60ea6d8756a0dc57b7482c067906f5f642343a1d79db4590b
                                                • Opcode Fuzzy Hash: 0b31c1cb01b0ea8030915de7962c80d906b64f010f1f32d504b4d9f5450a8081
                                                • Instruction Fuzzy Hash: 9B019E32440109EBCF169F51CE48AAA377AEB8DB49F008069BE14C4020DF35C962DF11
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A52214 Relevance: .5, Instructions: 507COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0976b9bade9b44b890411f7e2f743bbdde46fe87f04de5cab04b10c42faeb6f7
                                                • Instruction ID: 1d17e25b06cf1f10ca41ed5edc7eec8266c649207aeae8065ef359766261bc7a
                                                • Opcode Fuzzy Hash: 0976b9bade9b44b890411f7e2f743bbdde46fe87f04de5cab04b10c42faeb6f7
                                                • Instruction Fuzzy Hash: 7B127871548361CFD724DF25C58436BBBE5AF91308F24882DECA1922A1DF74DA49CB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A7F4CA Relevance: .4, Instructions: 399COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 39c15624a6b02d82799542c2d2a7f063a05e88055801bfcd20e351885c8ef305
                                                • Instruction ID: e3d399af8b9f285291e0e8288e5998545055b21a30485fb39a207b2e4a426e05
                                                • Opcode Fuzzy Hash: 39c15624a6b02d82799542c2d2a7f063a05e88055801bfcd20e351885c8ef305
                                                • Instruction Fuzzy Hash: C1F1BE75A00646EFCB25CF69C8806AABBF5FF48304F14816AD845D7B00EB70E625CBD9
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A4CED4 Relevance: .4, Instructions: 367COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 034ef5c14c4d21dfd8bea4665a4e0cd5cfe5c197526f873995705a524aedf679
                                                • Instruction ID: 67ace34c45d0d9b651a70a1470b006e66aedeb5593b635fa5bb860cb651eb333
                                                • Opcode Fuzzy Hash: 034ef5c14c4d21dfd8bea4665a4e0cd5cfe5c197526f873995705a524aedf679
                                                • Instruction Fuzzy Hash: 6CD1C771E802189EDB31AB14CC84BBAB7B8EF44718F9081D9E6059B181EF748EC6CF54
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A8206A Relevance: .3, Instructions: 303COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 34aa735318608728f1a19c6a27f6e55931f47a9e2636ea34dc008baa25a1ecbd
                                                • Instruction ID: 4e63e12e204ba1c36d534b3a23327cc9396fd342e4bb3dfaead2ef9f5366f44b
                                                • Opcode Fuzzy Hash: 34aa735318608728f1a19c6a27f6e55931f47a9e2636ea34dc008baa25a1ecbd
                                                • Instruction Fuzzy Hash: F0B1F230A003859FDB25EF68C880BB9BBF2FF89304F148499D945AB395DB349946CB61
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A96637 Relevance: .3, Instructions: 298COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 75d46abe1d04d2ddbf2af0bde1425930efbb12603fa372b2486c51cabb290943
                                                • Instruction ID: 3bd63e0a27704579a4ef4a86e4a61d4ff80c8c732100bce7abea4c2adb0f30e5
                                                • Opcode Fuzzy Hash: 75d46abe1d04d2ddbf2af0bde1425930efbb12603fa372b2486c51cabb290943
                                                • Instruction Fuzzy Hash: 24B13A71D402299BCF26DF96C990BEEBBF9AF08B04F05416AE905AB250DF719D41CF90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A778D4 Relevance: .3, Instructions: 271COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 84645be8f778b4a91760c0e66403ac6388fd07254ff8b3e4a02222a2ab672efa
                                                • Instruction ID: e254a2a8434cc1f70b24a14a3dc30537a35607e17ec951003a7b331dc6f9ad23
                                                • Opcode Fuzzy Hash: 84645be8f778b4a91760c0e66403ac6388fd07254ff8b3e4a02222a2ab672efa
                                                • Instruction Fuzzy Hash: FFB12976D022258FDF659F28CC88AA9F7B5EF88700F5546E9D809A7250EF309E81CF44
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A77F14 Relevance: .3, Instructions: 267COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 569d0397e86d24eaa1232c68d6b2400e4fb4828a962890d3fcad96eb4e22fdbf
                                                • Instruction ID: 00cdbd4a016ec852665327e64fb7f8b8bb919caf8146714974db8c5a6f429185
                                                • Opcode Fuzzy Hash: 569d0397e86d24eaa1232c68d6b2400e4fb4828a962890d3fcad96eb4e22fdbf
                                                • Instruction Fuzzy Hash: 2BB15776D026258FCF659F28CC8CAA9B7B5FF48701F144299D819A3260EF349E81DF84
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A81D8A Relevance: .3, Instructions: 257COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 010839459eed58c7aeced95ff5a89c08dfb96555962a2834384f38af59bf0485
                                                • Instruction ID: 6432d5b19879fdf52a9d16989f129606f73d5830a050ce0ecccc63dbd7517f1b
                                                • Opcode Fuzzy Hash: 010839459eed58c7aeced95ff5a89c08dfb96555962a2834384f38af59bf0485
                                                • Instruction Fuzzy Hash: 209181759002459FDF25EFA8C8807BABBF1EF49308F18449AD885AB351EB759D43CB60
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5D344 Relevance: .3, Instructions: 252COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4c9e7556b93f234fbef14254a89fcab98e69bffff8197ef33f5f90ba9147aa5c
                                                • Instruction ID: 979859644f426b084ac5c4ae5c427ccdb4a97ae24414896cb624f34300f1132b
                                                • Opcode Fuzzy Hash: 4c9e7556b93f234fbef14254a89fcab98e69bffff8197ef33f5f90ba9147aa5c
                                                • Instruction Fuzzy Hash: 14A135766187419FC715CF28C880AAABBF1FF88724F05896AFC5997261DB70E841CF52
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A97BE4 Relevance: .2, Instructions: 209COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f054e9d2a1b169deb5dbb1d08dd4a280559e538ae21868e1c407003356dc3dbe
                                                • Instruction ID: 08c1439794ced3baab3b134bb7018a8f5060d915464f661bffcb6e8eae8f5471
                                                • Opcode Fuzzy Hash: f054e9d2a1b169deb5dbb1d08dd4a280559e538ae21868e1c407003356dc3dbe
                                                • Instruction Fuzzy Hash: 96710872E443199FDF219F658C88B6AB7B9AF48715F100199E809AB290EF719E41CF90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A460CC Relevance: .2, Instructions: 201COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f9278b340b65e0a71ce06a51bcd472288e087d7565e57ea586bc09cc39557084
                                                • Instruction ID: ef540fed41c2a6ba03d4759e51142556d2abbda6fe64d9803d91e465214930bc
                                                • Opcode Fuzzy Hash: f9278b340b65e0a71ce06a51bcd472288e087d7565e57ea586bc09cc39557084
                                                • Instruction Fuzzy Hash: B581F371A41214DBCB22CF29CD98BE5B7B9FB85708F1045E9E848A7242DF70DA85CF54
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5CD54 Relevance: .2, Instructions: 201COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e03fa87fb0e2321992403985c3471593a916fa12763c5f90747c2e626b892bd2
                                                • Instruction ID: abbc5d91ae6d8b8756f6c6680338bc2021a6444f9eadd5ac6c916bc67bcfeace
                                                • Opcode Fuzzy Hash: e03fa87fb0e2321992403985c3471593a916fa12763c5f90747c2e626b892bd2
                                                • Instruction Fuzzy Hash: 9D619EB1A493619BD721CF24C880B6BB7EAAF88B64F04092EFD4597294DF70DD05CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A80707 Relevance: .2, Instructions: 185COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7e0848dc407298b04a3498d63be6e8720adaa6820bc55ae814b1fb25c2199cb6
                                                • Instruction ID: bd39c1641d9fd46c46c7a24a81c977742ffc7f909a73d843b8a795fa31c88eba
                                                • Opcode Fuzzy Hash: 7e0848dc407298b04a3498d63be6e8720adaa6820bc55ae814b1fb25c2199cb6
                                                • Instruction Fuzzy Hash: F951C032E40619AFDF21EB64CC84BBEB7BAEF48314F154165E941A7290DF709D49CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A58250 Relevance: .2, Instructions: 182COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 41dd20d6d2387b8d49be90b0f28d82288d76f3fa95df9bb29b0880df39f5ad10
                                                • Instruction ID: befb5a6be01428e02d152d563841e8ad9cbc8ff882fe1f15f58e0180d82dd669
                                                • Opcode Fuzzy Hash: 41dd20d6d2387b8d49be90b0f28d82288d76f3fa95df9bb29b0880df39f5ad10
                                                • Instruction Fuzzy Hash: 8C51B132A005219FCB25DF18C980A7BF7B6FF84B1475985A9DC429B611EF35EDC2C690
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A8E2C6 Relevance: .2, Instructions: 161COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 18093bebb7d702a5a51ef13378a568119831e47be4ddc85e281563a76c5df6b8
                                                • Instruction ID: 1095761995eadb6a7a40630019b27137303ee4e43ce050bb2db915feef62d21b
                                                • Opcode Fuzzy Hash: 18093bebb7d702a5a51ef13378a568119831e47be4ddc85e281563a76c5df6b8
                                                • Instruction Fuzzy Hash: 585163B1A002199BDF219B65CD84BAAB7BCEB49304F0041E5AA0DE3141EF71DE95CF55
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A593E3 Relevance: .2, Instructions: 160COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: bb38068400285a84a82d751486a1218b1bf4ba8b487b6a1f7f96bfa73d89a350
                                                • Instruction ID: dc0f11ec64d6353c7dac105008d6b132f872056f5def143a41e868b76a703a63
                                                • Opcode Fuzzy Hash: bb38068400285a84a82d751486a1218b1bf4ba8b487b6a1f7f96bfa73d89a350
                                                • Instruction Fuzzy Hash: 2D517832A40216DFDB24CF58C984BABB7B2EF88310F154169ED49AB291CB70ED11CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5958C Relevance: .2, Instructions: 160COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: fa0e1ecc429d395351644b8664f80fcea8897dd7c3219b5367222b465be8242a
                                                • Instruction ID: 05690bc7b9abed81335b04d46a423c29bd266e4f627a8ce03c289e0361c73ac9
                                                • Opcode Fuzzy Hash: fa0e1ecc429d395351644b8664f80fcea8897dd7c3219b5367222b465be8242a
                                                • Instruction Fuzzy Hash: BA518832A40216DFDB24DF59C984FABB7F6EB88310F154269ED05AB291CB30ED15CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A57394 Relevance: .2, Instructions: 151COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d2b11b463ce55ebce46d59d4517291633ed173dc2ee33e016f0d8870be6ff6dd
                                                • Instruction ID: c65080e1a59edd949529cc4efbee08d3ec296d9ffbba2c0ed8aaeb8b1d30e535
                                                • Opcode Fuzzy Hash: d2b11b463ce55ebce46d59d4517291633ed173dc2ee33e016f0d8870be6ff6dd
                                                • Instruction Fuzzy Hash: 6251A372A80625ABCB22AF65DD44F6FFBBAEF84711F004455FC01A6261DF34D911CB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A7F344 Relevance: .1, Instructions: 149COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8335ea361e19a9e67569546a3722b3de090950ee7d5ff26c9ffc2990a3846836
                                                • Instruction ID: 228eaf405f07747114e2f1e1cbbb8b7789cb8b47476f9ae886d62cae917b6031
                                                • Opcode Fuzzy Hash: 8335ea361e19a9e67569546a3722b3de090950ee7d5ff26c9ffc2990a3846836
                                                • Instruction Fuzzy Hash: 58413532641344AFDF328F148D84B6A7BB2BB80714F0880B9E956D7E90DF78DA41C759
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5844E Relevance: .1, Instructions: 145COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 1340cc00f73f6b29d2478aa9f82451f92c9d7e34e53080fbd50243207051d029
                                                • Instruction ID: e93dcaa703289a46c3275cf2f4c59a50b49a68fd09b7b2ac13d5b5a4d355c1df
                                                • Opcode Fuzzy Hash: 1340cc00f73f6b29d2478aa9f82451f92c9d7e34e53080fbd50243207051d029
                                                • Instruction Fuzzy Hash: D351AB32901625DFC722CF68C940A6AB7F9FF48700B154969EC46DB360EB34ED91CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A578B4 Relevance: .1, Instructions: 142COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: c4dc407ff8d0f086b2bd6f21cf9c637fb01093146cc5fe3c10e131366b8f8406
                                                • Instruction ID: b137927157cbaf57f7c159eb576d2f799167d857b5aa68cb1685a3abc32adfa4
                                                • Opcode Fuzzy Hash: c4dc407ff8d0f086b2bd6f21cf9c637fb01093146cc5fe3c10e131366b8f8406
                                                • Instruction Fuzzy Hash: 1C515D71A40215EFCB129FA5DD44FAFBBB9FB49B00F100429E901B62A0DF74D911CBA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A87DC4 Relevance: .1, Instructions: 140COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7816c59023c139d3be93c9f619d6a3f377195421acb085982b8cf1ccfb2dc611
                                                • Instruction ID: 4f44beaaeec95044a568d60398073e6b1c58b473b9323fa860dd3d86c5b4b731
                                                • Opcode Fuzzy Hash: 7816c59023c139d3be93c9f619d6a3f377195421acb085982b8cf1ccfb2dc611
                                                • Instruction Fuzzy Hash: 2141E576980200ABD7229FA4DD49F6BB7B8FF48B10F11481AF606DB2E1EE70C951C760
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A58BDB Relevance: .1, Instructions: 138COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b52f14a773c9dc23f259ab409c8952a636bf951bc268118f88cbc212c136c1a9
                                                • Instruction ID: 2d5e6e9a9d6104d717d4c4b47dbbfd93f31c479dfbd833ec12d8de475580abfe
                                                • Opcode Fuzzy Hash: b52f14a773c9dc23f259ab409c8952a636bf951bc268118f88cbc212c136c1a9
                                                • Instruction Fuzzy Hash: 29515875A02225DFCB24DF68C880A6BB7F1FF49704B1484A9E9059B251EB7CE9C0CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A9649F Relevance: .1, Instructions: 136COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 33e21d5698a2b6d9290c3d835eb5a5ef410ea21554955c37743c4201e502d8c1
                                                • Instruction ID: 6a7b15debc00fe43237dbaa07861a355ec44fc6c3334cb44b7e82f2e38b2e2dc
                                                • Opcode Fuzzy Hash: 33e21d5698a2b6d9290c3d835eb5a5ef410ea21554955c37743c4201e502d8c1
                                                • Instruction Fuzzy Hash: 67416F72D402299BCF12DF96C990BEEBBB9BF08714F010065EA01AB250DF719D55CF90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A45F16 Relevance: .1, Instructions: 131COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2bd6d46fd898381479cab956f390848739641a3426bf918da4e28ef617ab0e22
                                                • Instruction ID: e436d892f6282aaaa323ff342c6010549e547fba140b0c7114d5f590ea1e2ccb
                                                • Opcode Fuzzy Hash: 2bd6d46fd898381479cab956f390848739641a3426bf918da4e28ef617ab0e22
                                                • Instruction Fuzzy Hash: 4441A372A00118ABDB319F148C84FEAB7BDEBD5B54F4045A6E985A7190DFB0DEC1CE90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A47CA4 Relevance: .1, Instructions: 130COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7127be3795d69cf64eabeaf39afa27d0e9754a23c79fd090d6f9a81ef3a65f0a
                                                • Instruction ID: d54d65dd503716b8688035d68754505f2f3b856d57c819071b89d79cd9b109a0
                                                • Opcode Fuzzy Hash: 7127be3795d69cf64eabeaf39afa27d0e9754a23c79fd090d6f9a81ef3a65f0a
                                                • Instruction Fuzzy Hash: A6418072940249AFDB129FA8CD84FBABB79EB88344F050564F905E7251DF71DD11CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A58D54 Relevance: .1, Instructions: 128COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 32b083597435f8987508eaa3aee29abb38c8f30459984377de6b43025adf3b6e
                                                • Instruction ID: 62bd5fc970403c0ac9aa09883295641a40021ac83d6e958607f63e6e7361440a
                                                • Opcode Fuzzy Hash: 32b083597435f8987508eaa3aee29abb38c8f30459984377de6b43025adf3b6e
                                                • Instruction Fuzzy Hash: A4418B76600212DFCB24DF28D990B66B7F1FF48B40B254869ED46CB250EB34ED81CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A87A4E Relevance: .1, Instructions: 127COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0eda2988a9e108caf1d0c220470c046d2b9f52dcc1b0ba5f671a0ee08791ad18
                                                • Instruction ID: 8a0c7409abc6feea38d4ff0be63bdd7e335f739e88d58c0d75d93a27fa5de0b9
                                                • Opcode Fuzzy Hash: 0eda2988a9e108caf1d0c220470c046d2b9f52dcc1b0ba5f671a0ee08791ad18
                                                • Instruction Fuzzy Hash: 0041E336A40204ABDB21AB68DC09FAAF7B9EF48711F108519F512E72D1DF70D955CB60
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A97E8C Relevance: .1, Instructions: 127COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b9ecc8805c0d2ba7f0e0f69c0ff3be9ff760842853a1473a8d8df1195e1ae899
                                                • Instruction ID: 7f5e2451ef37e43b1d46f8989e4c6a927f86585964f90ff37739b6f0572d2a65
                                                • Opcode Fuzzy Hash: b9ecc8805c0d2ba7f0e0f69c0ff3be9ff760842853a1473a8d8df1195e1ae899
                                                • Instruction Fuzzy Hash: 1841BFB16587019BCB04DE16CC80F2BF7E5AFC4B14F00452EB998AB380EF70D905CAA2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A971EE Relevance: .1, Instructions: 123COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 1a9dd4d20358bfd132edcafd140dd0c642289e4728dfdad9d0499dfc6c7ebef1
                                                • Instruction ID: 01db2b983d5250c17956924651593056f57b2e24ee34afebccb223e258b7bf19
                                                • Opcode Fuzzy Hash: 1a9dd4d20358bfd132edcafd140dd0c642289e4728dfdad9d0499dfc6c7ebef1
                                                • Instruction Fuzzy Hash: 343138B2BD43016BDF159A6B8C80B6FF6E9DB55B14F0000A5ED40AB381EF71CD02CAA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A479A4 Relevance: .1, Instructions: 116COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 3d780cb529170c54920dfefa41e11c4e20b6bcac6af21d70ab8c69804c1b07cc
                                                • Instruction ID: b6a4c028e43028fdcabc0b04ccdc5ad9e552df2635b10f582711e788070e6286
                                                • Opcode Fuzzy Hash: 3d780cb529170c54920dfefa41e11c4e20b6bcac6af21d70ab8c69804c1b07cc
                                                • Instruction Fuzzy Hash: DF414D36E50249AFCB119FA4DD48AAEB7B9FF48300F114866E902D3261EF74DA11CB60
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A4951B Relevance: .1, Instructions: 113COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6e5feeeb7645b070e0f1d90e3cf829299cff3c9747e8febf406147f295af0456
                                                • Instruction ID: 34f2d231f45c567521c4f71c742ea3c5b73e79ac0347ade6683046aeb0a85a50
                                                • Opcode Fuzzy Hash: 6e5feeeb7645b070e0f1d90e3cf829299cff3c9747e8febf406147f295af0456
                                                • Instruction Fuzzy Hash: 06418E71540601EFC7228F58C844A6BFBF8FF84B11B158459F446DB260DF30E961CB95
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A95E8A Relevance: .1, Instructions: 110COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4718ba227fe94a393dcd3776aaef4226ded50b725bf4fbcea4a7bccd83979b92
                                                • Instruction ID: b70b56a218eac47895f025ab6a2d6388d84346ed7bcd745c24bea53b0c52c964
                                                • Opcode Fuzzy Hash: 4718ba227fe94a393dcd3776aaef4226ded50b725bf4fbcea4a7bccd83979b92
                                                • Instruction Fuzzy Hash: BC31A032A40A44EFDB229F96CD81F6BBBBAEF45710F114429F6019B660CB71EC11DB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A8194A Relevance: .1, Instructions: 102COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: c2c9d4c86623bcef858d585a4e5a3c424ed568b6d4fcff4382800b05125cfced
                                                • Instruction ID: b40e56391bebbd697fbc939712aa571d7df9fec657f53bc6581de64587ea9825
                                                • Opcode Fuzzy Hash: c2c9d4c86623bcef858d585a4e5a3c424ed568b6d4fcff4382800b05125cfced
                                                • Instruction Fuzzy Hash: E9417371A00606EFDB11DF98CC85EAAFBB8FB88310F144325E55592690DB70E965CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A94B4A Relevance: .1, Instructions: 101COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d9dce3c3369ddd0c55d9e5843658731d6e4744dfa12b3f3cf9fa9c6e7f379685
                                                • Instruction ID: 3c784e1b55d692c02c635a7d4f07b01e81b84345a2d525865a45368a99d79163
                                                • Opcode Fuzzy Hash: d9dce3c3369ddd0c55d9e5843658731d6e4744dfa12b3f3cf9fa9c6e7f379685
                                                • Instruction Fuzzy Hash: 8431D136A00154AACB249B5EC980B7AB3F9EF88719F15416AF641DB390EB74CD42D7A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A55BC8 Relevance: .1, Instructions: 99COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 804050267777ef2755009b130e7392813ca3058dbb5df7091d7ab038e3901f37
                                                • Instruction ID: 05b573f0ffcd638036ec691ce110a4162ec511399391d583c54c01de363f8f2f
                                                • Opcode Fuzzy Hash: 804050267777ef2755009b130e7392813ca3058dbb5df7091d7ab038e3901f37
                                                • Instruction Fuzzy Hash: 1831C032D402689FDB128FE8CC44BAEBBB5EB84711F914165F941AB294DFB5EC05CB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A9A4B6 Relevance: .1, Instructions: 98COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f3c15446c010ac5ef445ce192e2e1ade22b033fccf6bff317f678b1d50ef62e4
                                                • Instruction ID: 0dcb53d51a97b0ea6ec653ad04fcb2a026e988c72cd4e6cfb5b87d52deb2a4b1
                                                • Opcode Fuzzy Hash: f3c15446c010ac5ef445ce192e2e1ade22b033fccf6bff317f678b1d50ef62e4
                                                • Instruction Fuzzy Hash: DC213E32B80520ABDF11596B8C54E7F76F59F84755F010156FD45BB382EE70DD01CA91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A46C24 Relevance: .1, Instructions: 95COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: c83464683984704379d5dfa8f6754c070fee2caa6014516e3dbf7a8e5c477c75
                                                • Instruction ID: b0c9b503aed6a7ea3a05a5274dd89dd1dcd7f1a5dbf58cf840d2a7db65bd9265
                                                • Opcode Fuzzy Hash: c83464683984704379d5dfa8f6754c070fee2caa6014516e3dbf7a8e5c477c75
                                                • Instruction Fuzzy Hash: 34312B366405009FCB269F68DD94BBB773DFBC9B04B054568ED038A251EF71EA22C790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A769B2 Relevance: .1, Instructions: 93COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 362ae21ab374b8cdab5bcac20c76acbbd8e5fe070d7066c42b9c161c56712fd2
                                                • Instruction ID: beeb27b14e3e759ea9fd40e0cb55918ba298e0d0c0923920485b272855d01982
                                                • Opcode Fuzzy Hash: 362ae21ab374b8cdab5bcac20c76acbbd8e5fe070d7066c42b9c161c56712fd2
                                                • Instruction Fuzzy Hash: B8319171A00609EFDB15DF94CD80BAEB77DFF44700F14806AE905A7281DB709E50CB94
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5E3F3 Relevance: .1, Instructions: 89COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 05cf3504884a20487173cf517ef3ed7819d47d0fd0ec164d919bf0d241000654
                                                • Instruction ID: 335be67c2e8de6226aa22cdafeac1a825bda4e9c15637152d31878d19a7f019f
                                                • Opcode Fuzzy Hash: 05cf3504884a20487173cf517ef3ed7819d47d0fd0ec164d919bf0d241000654
                                                • Instruction Fuzzy Hash: 6B31AF32A51220DFC7238F26DA68B57BBB9EB88711F140069EC8197221EF318E01CF95
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A768DC Relevance: .1, Instructions: 88COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 5fa1632d3cfd41d7ee222ede6f7ed615c06f025f31c1d1db84265cc22ec1df91
                                                • Instruction ID: 1e1190fee0011633c0773671de1c90e633605cec39985cd418a0600d868a457b
                                                • Opcode Fuzzy Hash: 5fa1632d3cfd41d7ee222ede6f7ed615c06f025f31c1d1db84265cc22ec1df91
                                                • Instruction Fuzzy Hash: 0E312C76A00609AFDB15DFA9CD84EAEBBB9FF88750F14406AE805D7260DB70AD11CB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02AA42F0 Relevance: .1, Instructions: 82COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 61f42cbfaac52a99fb12be49d4fb340b5d50b69bf02baa5c5c69742d0e67d5e6
                                                • Instruction ID: c75cc30c221099a0a48c5cb57e0d5388108c3341c91d39c65bea5acb237e0793
                                                • Opcode Fuzzy Hash: 61f42cbfaac52a99fb12be49d4fb340b5d50b69bf02baa5c5c69742d0e67d5e6
                                                • Instruction Fuzzy Hash: F521D831A40210AFCB219F68ECA5B6EF778EF48B24F1146ADF425972D1DFB08901CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02AA4146 Relevance: .1, Instructions: 82COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 17f0b6e59a64056875f39b22d003ecbdea1f75203737550bcf36a7b68d9a4dc0
                                                • Instruction ID: 20a4ea6f6cb18df8ce33f92b6d152940ddf3cc87d2cb2ddd6b77bb761ccbfa2e
                                                • Opcode Fuzzy Hash: 17f0b6e59a64056875f39b22d003ecbdea1f75203737550bcf36a7b68d9a4dc0
                                                • Instruction Fuzzy Hash: 3E210B31A40614ABCB219F689CA5F6EF778EF88714F10466DF515A72D1DFB08D15CB80
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A45C24 Relevance: .1, Instructions: 79COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b5874ce198eb0c7cf31ed973f01101e7a452e0b93bc592e17f23b9fbf74d54f9
                                                • Instruction ID: ce4db531d4f137908ee33904606213c81a32c9ce528f484f5be559abdeaaefd3
                                                • Opcode Fuzzy Hash: b5874ce198eb0c7cf31ed973f01101e7a452e0b93bc592e17f23b9fbf74d54f9
                                                • Instruction Fuzzy Hash: BD219C31D41318ABDB21DBA19D89BEEBBBCAF80B58F440056E941A5092DFB0C615CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02AA3FB4 Relevance: .1, Instructions: 77COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8fd29d278f734ba2fdfe6a3b88f3a545f1ff6dd2fcc6b944fad38d9a44a75cad
                                                • Instruction ID: 7ba235e160ca1eedab3d49eb6160714b023e5694d2c238d87810ebd72d832ce2
                                                • Opcode Fuzzy Hash: 8fd29d278f734ba2fdfe6a3b88f3a545f1ff6dd2fcc6b944fad38d9a44a75cad
                                                • Instruction Fuzzy Hash: 3E21BA33981450EFCB229BA9DD58E5ABF79FF89B40F120458F50593272CB758A21EB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A96E47 Relevance: .1, Instructions: 76COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 11634e5919e1633f22f3327e5499a82cbac69d956789e322274b6cc09bd60caf
                                                • Instruction ID: 59def60f4c7f3775eb2353c38df414b44030ddc7448b06b85fdd50bba93a10c6
                                                • Opcode Fuzzy Hash: 11634e5919e1633f22f3327e5499a82cbac69d956789e322274b6cc09bd60caf
                                                • Instruction Fuzzy Hash: 02212632A80100ABCB109B68DC45EABF7BCFF84B11F014165F905E7250EF70E902CBA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A50FBB Relevance: .1, Instructions: 76COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 84ac9fa67c15e146d2efb4a0b2c2240c34e89767a462deaa477f58f9d353006e
                                                • Instruction ID: b50e68fc80b228a3cc5f682e50c67024401277560b5aeda3f6cc1762a4866d94
                                                • Opcode Fuzzy Hash: 84ac9fa67c15e146d2efb4a0b2c2240c34e89767a462deaa477f58f9d353006e
                                                • Instruction Fuzzy Hash: 0431D472D41164DBCB229B68CD8CBAABBBDBF04706F4409D4A809A21A1CF74DE95CE50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A58EE3 Relevance: .1, Instructions: 71COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 032672c6f264b3a20bd186eab3e6ff095d374a5c10ab783374c48112823aa9a4
                                                • Instruction ID: a7b6a96f12d0cbcc09210d9ad1a9571ffbe1aeefa658df561211a895d6abc2c6
                                                • Opcode Fuzzy Hash: 032672c6f264b3a20bd186eab3e6ff095d374a5c10ab783374c48112823aa9a4
                                                • Instruction Fuzzy Hash: 2E21AE32E41214AFC7229B68CD84B5BBB7AEB88B40F110069FC01A7351CF79DD52CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A46504 Relevance: .1, Instructions: 71COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a4c88f6876273d28fb9a36982368b3bdfa9c66ccc82e566fd624052400ddc405
                                                • Instruction ID: b88b8228244ce514dfe313bae4d7a99aee4a163bebaa33b3b26d8daff0273bee
                                                • Opcode Fuzzy Hash: a4c88f6876273d28fb9a36982368b3bdfa9c66ccc82e566fd624052400ddc405
                                                • Instruction Fuzzy Hash: 8F11D273680144FFD7129BA8CD88F6ABB7DEB89B50F010860F601C6161EE70DD11DB61
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A8E1EA Relevance: .1, Instructions: 70COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8251abd5db4bf7230fd7809a2821d8a6a7d8134ce57bd828c9bb6ee782b3bfef
                                                • Instruction ID: 2c0c239600ad1715ed50cd5664b15a13a773db7b1591619a20d29a2318092cb0
                                                • Opcode Fuzzy Hash: 8251abd5db4bf7230fd7809a2821d8a6a7d8134ce57bd828c9bb6ee782b3bfef
                                                • Instruction Fuzzy Hash: 99219276A11144DFCB02EF29CAE4EA6F7BDFB44308F104669E80597711EF30A915CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A48AC4 Relevance: .1, Instructions: 66COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4254cface0af5b19f9731c852ad859e4b6cee243d841ecbd00f2312f6b26f868
                                                • Instruction ID: 9f3488988b9c3d810d6f758355ccb915b6cfeb93f23a0ec9fc0d40e464436729
                                                • Opcode Fuzzy Hash: 4254cface0af5b19f9731c852ad859e4b6cee243d841ecbd00f2312f6b26f868
                                                • Instruction Fuzzy Hash: C021C676A40204AFC7019F65DC88FAEBBB8EB88716F104155FA01AA241DF74D905CFA5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A55CD0 Relevance: .1, Instructions: 65COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 794d98980b095fa48472662612f01e93c144d57903e7fb7bb1a1c271a7d1c812
                                                • Instruction ID: 2fb7e092d146e76bb09e69ee90dc4f3d0895a20b1dfa143ef4b485d5053536b6
                                                • Opcode Fuzzy Hash: 794d98980b095fa48472662612f01e93c144d57903e7fb7bb1a1c271a7d1c812
                                                • Instruction Fuzzy Hash: DB217273E00225EFCB14DF89C5C4A6ABBB9EF48710B55406AED0597311DB70ED41CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A4FE58 Relevance: .1, Instructions: 59COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2423b1cae5eca1a4ff938dfde14931bc4e5ce9d2289f6bbfe7fe21913480ab78
                                                • Instruction ID: a803065af00b393ecddbd280aee8724b14e61d8e9023dbf38005c6e725be09e2
                                                • Opcode Fuzzy Hash: 2423b1cae5eca1a4ff938dfde14931bc4e5ce9d2289f6bbfe7fe21913480ab78
                                                • Instruction Fuzzy Hash: 5C11C236A41600AFD3268B48DD95F2AB7A9FB88711F100568F90AD3792CF74ED21CA50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A4E9E4 Relevance: .0, Instructions: 39COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2399a71c9e7161e136ab1995fb69c6480d83f909e0e6439b9e8d3bcf5579e505
                                                • Instruction ID: c4c6ff7d4a8dbb75381d46083daec57fb4a4ae9d2c634829649ec16078c3c920
                                                • Opcode Fuzzy Hash: 2399a71c9e7161e136ab1995fb69c6480d83f909e0e6439b9e8d3bcf5579e505
                                                • Instruction Fuzzy Hash: D1F0FF32140640DBC7129F699E08E5B7BB8FFC9701F05882AF50183621DF34D825CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A57A52 Relevance: .0, Instructions: 36COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2579fd8e4b8ea84eed1c722f1b3ee00abc39d1bb21ef2f96c6caf6b1f34c5e77
                                                • Instruction ID: 25d8c01813cfe9132e04e95fb7794a552f95f6c02fb4abe10f8a799838eef9d3
                                                • Opcode Fuzzy Hash: 2579fd8e4b8ea84eed1c722f1b3ee00abc39d1bb21ef2f96c6caf6b1f34c5e77
                                                • Instruction Fuzzy Hash: E0011272541980EFC3329F1ADD48E03FBB9FB95B10B028969F40682A71CB34D852CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A564A4 Relevance: .0, Instructions: 30COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 99c1d0906b9cd8628dd3d4f9a1b874e912dd41a339b78365fa21ec97cc8a3210
                                                • Instruction ID: 20e0495c866fac6365d988759d244201fe08cb439dfee26c5aaedfc8525418f5
                                                • Opcode Fuzzy Hash: 99c1d0906b9cd8628dd3d4f9a1b874e912dd41a339b78365fa21ec97cc8a3210
                                                • Instruction Fuzzy Hash: 6AF04932181A50DBC7229F19CE98B56BBB5FB48B01F800828E942029F0CF74F891CA80
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A57ABA Relevance: .0, Instructions: 26COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 70defe9fb2edcc8e6aab81dadc2d32409a17c1d2441293418b690f003d238299
                                                • Instruction ID: fc92c238ee5bb59093200453332b57c9d89928e7319224ca9db9e783393a0525
                                                • Opcode Fuzzy Hash: 70defe9fb2edcc8e6aab81dadc2d32409a17c1d2441293418b690f003d238299
                                                • Instruction Fuzzy Hash: 70F08C33141660ABC7328F18DD04B12B775FB80B20F160918F9052B5A1CB71E802CA90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A77CBC Relevance: .0, Instructions: 21COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d3eaaede5734780794cc055369f25c1e4a36746a438aa188b82ce2e16defc029
                                                • Instruction ID: b55c82c02184b0b3745c7b2384fffd3347fa0718c7d53961c5f383792a0e5136
                                                • Opcode Fuzzy Hash: d3eaaede5734780794cc055369f25c1e4a36746a438aa188b82ce2e16defc029
                                                • Instruction Fuzzy Hash: B7F0A5729824649FDF269F14CE58F59FB79FB48B10F090594A809A3671CF30ADA1CE80
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A782F8 Relevance: .0, Instructions: 19COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: cd5ea17d95882e73cb059739879d73a3b6f261dfea14d48959d338947df70506
                                                • Instruction ID: cbf51ea0e4615ca9b6a43fd84cde6d6f7fc0bae2d554a2f160c82c894bca1566
                                                • Opcode Fuzzy Hash: cd5ea17d95882e73cb059739879d73a3b6f261dfea14d48959d338947df70506
                                                • Instruction Fuzzy Hash: CDE01A76A41445DFDF269F19CE98F65B379FB44700F0501D8B809A36A1CB34ED51CE90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A81121 Relevance: .0, Instructions: 18COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 9797d141c7ff3619ebadbb88b5ce810a5a52560bc1182f494f1ae57ffb2c9dff
                                                • Instruction ID: 20859df29882b534183a9679e9e86acd1c2d3cff0c70192415c5ca2c24dbbf61
                                                • Opcode Fuzzy Hash: 9797d141c7ff3619ebadbb88b5ce810a5a52560bc1182f494f1ae57ffb2c9dff
                                                • Instruction Fuzzy Hash: 2DE0EC72650480EFCB169F5CED54E2AB7B9FB88B04F06451CB005D35A1DF34D852CA54
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A76342 Relevance: .0, Instructions: 12COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4b5358e4552dbe765743de758b630f936962216e3bd41f9547b8ff7f7bde0c8f
                                                • Instruction ID: 5df4080518205a31bb820c3325197497ae87bc89a2813a864b567f4652f05034
                                                • Opcode Fuzzy Hash: 4b5358e4552dbe765743de758b630f936962216e3bd41f9547b8ff7f7bde0c8f
                                                • Instruction Fuzzy Hash: 4DD0C971C41954DBCF229F59CDA8B6ABA78BB44F05F0280A4E421615608B348841CE95
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5CFF4 Relevance: .0, Instructions: 12COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b68ef31346f6bde32d5131644d4b201729c15d6b01934f8b7b7e6ddd246af0d8
                                                • Instruction ID: bb7619d45798da369513d82c9bcfdac211deacff68afb81c866228ce9364586f
                                                • Opcode Fuzzy Hash: b68ef31346f6bde32d5131644d4b201729c15d6b01934f8b7b7e6ddd246af0d8
                                                • Instruction Fuzzy Hash: 72D01232080A48EBC7225F48DD48F55BB69FB94750F158024BA09065F2CB75D9A1DA84
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A8BC57 Relevance: .0, Instructions: 12COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: afb62427c36b10cc585ce071c720ed5e665fa02d201a1ecd939b5093f603f2ba
                                                • Instruction ID: c9647b937afc7f1c56d71433b1498658914c4612a9cfbc17e101c4f15fd17f61
                                                • Opcode Fuzzy Hash: afb62427c36b10cc585ce071c720ed5e665fa02d201a1ecd939b5093f603f2ba
                                                • Instruction Fuzzy Hash: 84C01272651980DACB116B38CA0472177F4E74460AF0508B4A116C1075DF64D482D510
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A905C6 Relevance: .0, Instructions: 11COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f29c5dd3ef747f7215b2f73a40abf8f655297ec6ecf60db2c77c253fb35f5fc9
                                                • Instruction ID: 0602f2a49e13b8a081bfefbe2150828d969dfa9064c1fbafb5a7057c2f399e42
                                                • Opcode Fuzzy Hash: f29c5dd3ef747f7215b2f73a40abf8f655297ec6ecf60db2c77c253fb35f5fc9
                                                • Instruction Fuzzy Hash: D6D01275D92754D7DB22AB54CA2075EB770EF40B20F904285E4913B6C0CB781B01DF85
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A76838 Relevance: .0, Instructions: 8COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 9c2dcd453cdcef2f5a7ffcd11799c7baedb428be437c7ef2b690e8e7af168a51
                                                • Instruction ID: 72d4e44e39151c004c958805bb3c34e4cd4d29dbbd14d6a55c3c37ca6bb0d948
                                                • Opcode Fuzzy Hash: 9c2dcd453cdcef2f5a7ffcd11799c7baedb428be437c7ef2b690e8e7af168a51
                                                • Instruction Fuzzy Hash: 7CC09B342419408BCE15DF20CBA0B6C3769BBC4B44F5405F8CC494B551DF269901CD04
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 02A5D2EB Relevance: .0, Instructions: 6COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.748233445.0000000002A45000.00000040.00000020.00020000.00000000.sdmp, Offset: 02A45000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_2a45000_loaddll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 63baa3b1bba31b5591da200c227a0bd23fe627472b1a2ddb46bcf4566bee72f0
                                                • Instruction ID: ea9ec8e8acfd4ec21f6d308191fe528d612b0e848d221628cf916efe1135e618
                                                • Opcode Fuzzy Hash: 63baa3b1bba31b5591da200c227a0bd23fe627472b1a2ddb46bcf4566bee72f0
                                                • Instruction Fuzzy Hash: 23B012725D0480EFDF179F18CE19F107734F740B00F010554B101454F1DAA4EC11CA40
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Executed Functions

                                                Function 04462995 Relevance: .0, Instructions: 16COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000003.00000002.762100098.000000000445E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0445E000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_3_2_445e000_rundll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 085bd4bb251dd28091244ce6a609ff2f43f6279936c20b6ef76cbaf2ce03e1d8
                                                • Instruction ID: 19ed6006a711a324b4d63bddfa5c65cfbfd999f8281114907590d5766372d479
                                                • Opcode Fuzzy Hash: 085bd4bb251dd28091244ce6a609ff2f43f6279936c20b6ef76cbaf2ce03e1d8
                                                • Instruction Fuzzy Hash: DED0177300010DBBDF024E80DC01EDA3F2AEB48370F044100FE34410A0C636C9B0ABA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04463495 Relevance: .0, Instructions: 9COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000003.00000002.762100098.000000000445E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0445E000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_3_2_445e000_rundll32.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4075ea421c92f8709cc1dc95c2c7f1a7b4400a2df2f87f77e190c1e43f8afbfe
                                                • Instruction ID: 2704e0d55d6e925ad58ca1fcb0921dad6319422c47fce23c18e1db87ad5a9ba9
                                                • Opcode Fuzzy Hash: 4075ea421c92f8709cc1dc95c2c7f1a7b4400a2df2f87f77e190c1e43f8afbfe
                                                • Instruction Fuzzy Hash: BEC0483600010CFB8F426E82E808C9A7F2AEB98361B058012FA18090209B379E25EB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%